CVE-2026-55856

Received Received - Intake

MariaDB Connector/J SSL Certificate Validation Bypass

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding. The OK-packet and authentication-switch paths enforce the certificate fingerprint, but the initial-handshake path does not. HandshakeResponse.encode() can therefore build and send a mysql_clear_password response before checking certFingerprint != null && !isMitMProof(), sslMode, or whether the authentication plugin is resistant to a man-in-the-middle, and the initial path also bypasses restrictedAuth. An active man-in-the-middle or hostile server can present a self-signed certificate, claim to be MariaDB, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55856

Affected Vendors & Products

Vendor	Product	Version / Range
mariadb	connector_j	2.7.14
mariadb	connector_j	3.3.5
mariadb	connector_j	3.4.3
mariadb	connector_j	3.5.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

MariaDB Connector/J before versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9 has a flaw where it accepts untrusted self-signed certificates during SSL connections with verify-full or verify-ca modes if fallbackToSystemTrustStore is enabled. The connector fails to validate the certificate fingerprint during the initial handshake, allowing a man-in-the-middle attacker to intercept and receive the database password via mysql_clear_password authentication before rejecting the connection.

Detection Guidance

Check MariaDB Connector/J versions in use. If using versions prior to 2.7.14, 3.3.5, 3.4.3, or 3.5.9, the system is vulnerable. Inspect Java applications for connections with sslMode=verify-full or sslMode=verify-ca without proper serverSslCert or trustStore configuration.

Impact Analysis

An attacker could intercept your database connection, steal credentials, and gain unauthorized access to sensitive data. This could lead to data breaches, unauthorized modifications, or complete database compromise if the attacker uses the stolen password.

Compliance Impact

This vulnerability could lead to unauthorized access to database passwords, potentially violating data protection requirements under GDPR and HIPAA. Exposure of credentials may result in unauthorized data access or breaches, which are key compliance concerns for these regulations.

Mitigation Strategies

Upgrade MariaDB Connector/J to versions 2.7.14, 3.3.5, 3.4.3, or 3.5.9 or later. Ensure sslMode is properly configured with serverSslCert or trustStore. Disable fallbackToSystemTrustStore if not required.

Hi! I’m here to help you understand CVE-2026-55856. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70