Executive brief
MariaDB Connector/J is a JDBC driver used by Java applications to connect to MariaDB databases. When using PAM (dialog) authentication over an unencrypted connection, an attacker positioned on the network path can force the driver to send database account passwords in cleartext, allowing credential theft and unauthorized database access. This occurs by default in unmodified installations connecting over plain TCP.
Technical details
The vulnerability is a cleartext transmission of credentials (CWE-319, CWE-522) in the PAM authentication handler (SendPamAuthPacketFactory). The driver's mysql_clear_password plugin was correctly gated to require secure transport (TLS or Unix socket), but the PAM plugin inherited a default value permitting cleartext transmission over plain TCP. An attacker or MITM server can trigger an Authentication Switch Request to negotiate the dialog plugin, causing the driver to respond with the user's cleartext password. The root cause is missing secure-transport enforcement in the PAM handler. Attack preconditions: unencrypted connection (sslMode=DISABLE by default), no plugin whitelist (restrictedAuth=null by default), and MITM capability or connection to attacker-controlled server. Patches enforce PAM to require TLS or Unix socket, identical to mysql_clear_password policy. Fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
Affected products
- MariaDB Connector/J < 2.7.14, >= 3.0.0 and < 3.3.5, >= 3.4.0 and < 3.4.3, >= 3.5.0 and < 3.5.9
Timeline
- 2026-08-28: disclosed: Advisory published on GitHub
- 2026: patched: Fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9