Executive brief
The MariaDB R2DBC connector (a database driver library) fails to require encrypted connections before sending database account passwords in cleartext during authentication. An attacker positioned on the network between an application and database server can intercept and capture credentials, then use them to access the database directly.
Technical details
The vulnerability exists in the AuthenticationPlugin interface, which does not provide a mechanism for plugins to declare a requirement for secure transport. This allows clear-text authentication plugins (mysql_clear_password and dialog/PAM) to execute over unencrypted plain-TCP connections. An attacker positioned as a man-in-the-middle or operating a malicious MariaDB server can request a clear-text plugin over an unencrypted connection and receive the user's plaintext password. The root cause is the absence of a security gate preventing clear-text plugins from running on non-encrypted channels. The vulnerability is fixed in version 1.4.1, which adds a contract allowing plugins to require secure transport; clear-text plugins are now restricted to encrypted connections. Workarounds include explicitly configuring certificate verification with a verifying SSL mode (VERIFY_CA or VERIFY_FULL) to ensure encryption and server identity validation before credentials are sent.
Affected products
- MariaDB R2DBC Connector (org.mariadb:r2dbc-mariadb) < 1.4.1
Timeline
- 2026-07-09: disclosed: Published to GitHub Advisory Database
- 2026-08-28: advisory: Advisory updated and formally reviewed
- 2026-08-28: patched: Fix available in version 1.4.1