CVE-2026-55854

Received Received - Intake

Password Disclosure in MariaDB Connector/Node.js

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55854

Affected Vendors & Products

Vendor	Product	Version / Range
mariadb	mariadb_connector_node.js	to 3.2.4 (inc)
mariadb	mariadb_connector_node.js	3.3.3
mariadb	mariadb_connector_node.js	3.4.6
mariadb	mariadb_connector_node.js	3.5.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability affects MariaDB Connector/Node.js versions before 3.2.4, 3.3.3, 3.4.6, and 3.5.3. When using PAM dialog authentication over an insecure connection, the connector may disclose account passwords in cleartext. This happens because the authentication process does not enforce secure transport for the PAM password exchange.

Detection Guidance

Detecting this vulnerability requires checking if your MariaDB Connector/Node.js version is below 3.2.4, 3.3.3, 3.4.6, or 3.5.3. Use commands like 'npm list mariadb-connector-nodejs' or check package.json for version details. Inspect network traffic for plaintext password exchanges during PAM authentication.

Impact Analysis

If exploited, an attacker on the same network could intercept plaintext passwords during authentication. This could lead to unauthorized access to databases, data breaches, or further network compromise. The risk is higher when using default settings like sslMode=DISABLE and restrictedAuth=null.

Compliance Impact

This vulnerability could violate compliance requirements that mandate encryption for data in transit, such as GDPR's data protection principles or HIPAA's security rule. Unauthorized disclosure of credentials may lead to regulatory penalties due to insufficient safeguards.

Mitigation Strategies

Upgrade MariaDB Connector/Node.js to versions 3.2.4, 3.3.3, 3.4.6, or 3.5.3 or later. Ensure sslMode is not set to DISABLE and avoid using restrictedAuth=null. Use verified TLS for all connections and prefer Unix sockets for local connections.

Hi! I’m here to help you understand CVE-2026-55854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70