CVE-2026-55854: MariaDB Connector/Node.js cleartext password transmission in PAM authentication

CVE-2026-55854 · Severity: medium · CVSS 5.9 · Published 2026-08-28

The MariaDB Node.js database connector can be tricked into sending database account passwords in plaintext over unencrypted network connections when using PAM (dialog) authentication. An attacker positioned on the network or controlling a malicious database server can intercept these credentials and use them to gain unauthorized access to databases. This vulnerability only affects deployments using unencrypted TCP connections with default configuration.

Technologies: Mariadb Connector/Node.js. Vendors: Mariadb.

Quick answers

Is CVE-2026-55854 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55854 being exploited in the wild.
How severe is CVE-2026-55854?
Medium severity, with a CVSS score of 5.9, published 28 August 2026.
Which products and versions are affected?
Mariadb Connector/Node.js < 3.2.4, >= 3.3.0 and < 3.3.3, >= 3.4.0 and < 3.4.6, >= 3.5.0 and < 3.5.3, < 3.2.4; >= 3.3.0 and < 3.3.3; >= 3.4.0 and < 3.4.6; >= 3.5.0 and < 3.5.3.
Is there a fix for CVE-2026-55854?
A patch was published on 2026-06-08: Patches released for versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55854 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55854?
Check whether you run Mariadb Connector/Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cleartext transmission and insufficient credential protection issue (CWE-319, CWE-522) in the mariadb npm package. The PAM authentication plugin handler (SendPamAuthPacketFactory) did not enforce the same secure-transport requirement as the existing mysql_clear_password plugin, allowing an attacker to issue an Authentication Switch Request over plain TCP to trigger plaintext password transmission. The attack requires network-level access (man-in-the-middle position) or the ability to cause the client to connect to a controlled server. With default configuration (sslMode=DISABLE, restrictedAuth=null), this is fully exploitable with no non-default options required. Properly verified TLS connections and Unix sockets are not affected. Fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3, where PAM authentication now requires a secure transport layer (TLS or local Unix socket).

Affected products

  • MariaDB Connector/Node.js (mariadb npm package) < 3.2.4; >= 3.3.0 and < 3.3.3; >= 3.4.0 and < 3.4.6; >= 3.5.0 and < 3.5.3

Identifiers

  • CVE-2026-55854
  • GHSA-42r5-vhpq-m858

Timeline

  • 2026-08-28: disclosed
  • 2026-06-08: patched: Patches released for versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3
  • 2026-07-09: other: GitHub advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.