Junglewise Threat Intelligence

CVE-2026-55856: MariaDB Connector/J cleartext password disclosure in MITM

CVE-2026-55856 · Severity: medium · CVSS 5.9 · Published 2026-08-28

Executive brief

MariaDB Connector/J is a Java database driver used to connect applications to MariaDB databases. When configured with TLS verification (sslMode=verify-full/verify-ca) but without pinned certificates, an attacker positioned on the network can intercept the connection and steal the plaintext database password during the initial authentication handshake, before any certificate verification occurs. This allows the attacker to take over the database account and access all data the victim account can reach.

Technical details

MariaDB Connector/J has an authentication bypass and credential disclosure vulnerability (CWE-522: Insufficiently Protected Credentials). When using sslMode=verify-full or verify-ca with a password but no pinned server certificate, the connector accepts a self-signed certificate at the TLS layer and defers identity verification via certificate fingerprint checking. However, the initial-handshake authentication path (HandshakeResponse.encode()) fails to enforce fingerprint verification before sending credentials with the mysql_clear_password plugin. An active network attacker can present a self-signed certificate, claim to be the MariaDB server, and receive the plaintext database password before any fingerprint validation occurs. The fingerprint check is correctly applied on the auth-switch and OK-packet paths but was missing from the initial-handshake path. The fix applies the same certFingerprint and MITM-proof checks to the initial-handshake path, refusing to send clear-password responses on unverified certificates. Patches are available in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

Affected products

  • MariaDB Connector/J < 2.7.14, >= 3.0.0 and < 3.3.5, >= 3.4.0 and < 3.4.3, >= 3.5.0 and < 3.5.9

Timeline

  • 2026-07-09: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-06-09: patched: Fixes committed and released in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9
  • 2026-08-28: advisory: Advisory updated in GitHub Advisory Database

References