CVE-2026-55860

Received Received - Intake

MariaDB Connector/R2DBC Cleartext Password Authentication Bypass

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55860

Affected Vendors & Products

Vendor	Product	Version / Range
org.mariadb	r2dbc-mariadb	to 1.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

MariaDB Connector/R2DBC before 1.4.1 allows a man-in-the-middle server to extract plaintext passwords via clear-text authentication plugins over unencrypted connections. The AuthenticationPlugin interface lacks a requirement for secure transport, enabling AuthSwitchRequest to send credentials insecurely.

Detection Guidance

Detect this vulnerability by checking the version of org.mariadb:r2dbc-mariadb in use. If it is below 1.4.1, the system is vulnerable. Inspect network traffic for plaintext password authentication attempts over unencrypted connections.

Impact Analysis

Attackers could intercept and steal database credentials, leading to unauthorized access to sensitive data. This could result in data breaches, loss of confidential information, or further exploitation of the database system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR and HIPAA requirements for data protection and encryption. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade org.mariadb:r2dbc-mariadb to version 1.4.1 or later. Ensure all database connections use encrypted transport to prevent plaintext password exposure.

Hi! I’m here to help you understand CVE-2026-55860. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70