Junglewise Threat Intelligence

CVE-2026-55854: MariaDB Connector/Node.js cleartext password transmission in PAM authentication

CVE-2026-55854 · Severity: medium · CVSS 5.9 · Published 2026-08-28

Executive brief

The MariaDB Node.js database connector can be tricked into sending database account passwords in plaintext over unencrypted network connections when using PAM (dialog) authentication. An attacker positioned on the network or controlling a malicious database server can intercept these credentials and use them to gain unauthorized access to databases. This vulnerability only affects deployments using unencrypted TCP connections with default configuration.

Technical details

The vulnerability is a cleartext transmission and insufficient credential protection issue (CWE-319, CWE-522) in the mariadb npm package. The PAM authentication plugin handler (SendPamAuthPacketFactory) did not enforce the same secure-transport requirement as the existing mysql_clear_password plugin, allowing an attacker to issue an Authentication Switch Request over plain TCP to trigger plaintext password transmission. The attack requires network-level access (man-in-the-middle position) or the ability to cause the client to connect to a controlled server. With default configuration (sslMode=DISABLE, restrictedAuth=null), this is fully exploitable with no non-default options required. Properly verified TLS connections and Unix sockets are not affected. Fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3, where PAM authentication now requires a secure transport layer (TLS or local Unix socket).

Affected products

  • MariaDB Connector/Node.js (mariadb npm package) < 3.2.4; >= 3.3.0 and < 3.3.3; >= 3.4.0 and < 3.4.6; >= 3.5.0 and < 3.5.3

Timeline

  • 2026-08-28: disclosed
  • 2026-06-08: patched: Patches released for versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3
  • 2026-07-09: other: GitHub advisory published

References

Related threats