CVE-2026-55215

Received Received - Intake

MariaDB Connector/Node.js Credential Exposure via MITM

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing mysql_clear_password to send the credential first. An active man-in-the-middle can present a self-signed certificate, capture the database password, and use it to authenticate directly even though the connector later rejects the server and closes the connection. This issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55215

EUVD

EUVD-2026-67869

Affected Vendors & Products

Vendor	Product	Version / Range
mariadb	mariadb_connector_node.js	3.3.3
mariadb	mariadb_connector_node.js	3.4.6
mariadb	mariadb_connector_node.js	3.5.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

MariaDB Connector/Node.js versions before 3.3.3, 3.4.6, and 3.5.3 have a flaw where credentials are sent before certificate validation when SSL is enabled without a pinned CA or server certificate. A man-in-the-middle can exploit this by presenting a self-signed certificate, capturing the password, and authenticating directly even though the connection is later rejected.

Detection Guidance

This vulnerability involves MariaDB Connector/Node.js sending credentials before completing certificate validation when SSL is enabled without a pinned CA or server certificate. Detection requires checking the version of MariaDB Connector/Node.js in use. If using versions prior to 3.3.3, 3.4.6, or 3.5.3, the system is vulnerable. No specific commands are provided in the context to detect active exploitation.

Impact Analysis

An attacker could intercept database credentials during transmission, potentially gaining unauthorized access to sensitive data. This could lead to data breaches, unauthorized modifications, or complete database compromise if the credentials allow further access.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade MariaDB Connector/Node.js to versions 3.3.3, 3.4.6, or 3.5.3 or later. Ensure SSL is configured with a pinned CA or server certificate to prevent credential interception. Review authentication plugins in use and avoid mysql_clear_password where possible.

Hi! I’m here to help you understand CVE-2026-55215. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70