CVE-2026-55857

Received Received - Intake

MariaDB Connector/J PAM Authentication Password Exposure

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysql_clear_password plugin is gated behind a secure transport, but the sibling PAM handler SendPamAuthPacketFactory, named dialog by the server, does not declare that requirement and inherits the default secure-required value false; older branches implement the same affected behavior in SendPamAuthPacket. A hostile or man-in-the-middle server can send an Authentication Switch Request for dialog over plain TCP, causing the driver to return the user's password in cleartext when sslMode=DISABLE and restrictedAuth=null, which is the default configuration. Properly verified TLS and local Unix sockets are not exposed to this transport vector. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55857

Affected Vendors & Products

Vendor	Product	Version / Range
mariadb	mariadb_connector_j	to 2.7.14 (exc)
mariadb	mariadb_connector_j	to 3.3.5 (exc)
mariadb	mariadb_connector_j	to 3.4.3 (exc)
mariadb	mariadb_connector_j	to 3.5.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

MariaDB Connector/J versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9 have a flaw in PAM dialog authentication. When using the default settings, the driver may send the user's password in cleartext over an insecure connection if a malicious server requests it via an Authentication Switch Request for the dialog method.

Detection Guidance

This vulnerability can be detected by checking the version of MariaDB Connector/J in use. If your application uses versions prior to 2.7.14, 3.3.5, 3.4.3, or 3.5.9, it is vulnerable. Inspect dependency files like pom.xml for Maven or build.gradle for Gradle to verify the version.

Impact Analysis

An attacker could intercept the password during transmission if the connection is not secured with TLS or uses local Unix sockets. This could lead to unauthorized access to the database or related systems if the password is reused elsewhere.

Compliance Impact

This vulnerability may violate data protection requirements under GDPR and HIPAA, as it exposes sensitive credentials in transit. Organizations using affected versions could face compliance violations and potential penalties.

Mitigation Strategies

Upgrade MariaDB Connector/J to version 2.7.14, 3.3.5, 3.4.3, or 3.5.9 or later. Ensure TLS is properly configured and avoid using sslMode=DISABLE or restrictedAuth=null in your connection settings.

Hi! I’m here to help you understand CVE-2026-55857. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70