CVE-2026-55215— MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`
Quick assessment
Affected
mariadb-corporation mariadb-connector-nodejs
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MariaDB R2DBC connector是MariaDB基金会的一款关系数据库响应式连接器。 MariaDB R2DBC connector 3.3.3之前版本、3.4.6之前版本和3.5.3之前版本存在安全漏洞，该漏洞源于启用SSL但未固定CA或服务器证书时，连接器在完成证书指纹验证前发送凭据，且认证切换可能错误评估之前的插件，导致中间人攻击者可通过自签名证书捕获数据库密码。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| mariadb-corporation | mariadb-connector-nodejs | < 3.2.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55215
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`
Source: CVE Program / CVE List V5
Vulnerability Description
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing mysql_clear_password to send the credential first. An active man-in-the-middle can present a self-signed certificate, capture the database password, and use it to authenticate directly even though the connector later rejects the server and closes the connection. This issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
MariaDB R2DBC connector 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MariaDB R2DBC connector是MariaDB基金会的一款关系数据库响应式连接器。 MariaDB R2DBC connector 3.3.3之前版本、3.4.6之前版本和3.5.3之前版本存在安全漏洞，该漏洞源于启用SSL但未固定CA或服务器证书时，连接器在完成证书指纹验证前发送凭据，且认证切换可能错误评估之前的插件，导致中间人攻击者可通过自签名证书捕获数据库密码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mariadb-corporation | mariadb-connector-nodejs | < 3.2.4 | - |
|
II. Public POCs for CVE-2026-55215
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55215
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55215 (3)
Vendor Advisories for CVE-2026-55215 (1)
Vendor Pages for CVE-2026-55215 (4)
Other References for CVE-2026-55215 (1)
-
🔗 Sign in | HackerOne x_refsource_MISC
Same Patch Batch · mariadb-corporation · 2026-08-28 · 8 CVEs total
| CVE-2026-55855 | 6.5 MEDIUM | MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/ |
| CVE-2026-55854 | 5.9 MEDIUM | MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficien |
| CVE-2026-55856 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake |
| CVE-2026-55860 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clea |
| CVE-2026-55859 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding o |
| CVE-2026-55857 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Pr |
| CVE-2026-55858 | 5.9 MEDIUM | MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb |
IV. Related Vulnerabilities
Same product: mariadb-connector-nodejs
-
CVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protoco -
CVE-2026-107384
MariaDB Connector/Node.js: SQL injection through object keys -
CVE-2026-107383
MariaDB Connector/Node.js exposes uninitialized process memo -
CVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the cl -
CVE-2026-55855
MariaDB Connector/Node.js: Possible SQL injection in Buffer
Same vendor: mariadb-corporation
-
CVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protoco -
CVE-2026-107384
MariaDB Connector/Node.js: SQL injection through object keys -
CVE-2026-107383
MariaDB Connector/Node.js exposes uninitialized process memo -
CVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the cl -
CVE-2026-61700
MariaDB Connector/J does not enforce allowLocalInfile=false
Same weakness: CWE-295
-
CVE-2026-109383
undici vulnerable to TLS certificate validation bypass via d -
CVE-2023-32198
Steve doesn’t verify a server’s certificate and is susceptib -
CVE-2025-23390
Fleet doesn’t validate a server’s certificate when connectin -
CVE-2026-19377
Improper certificate validation in Cato Client tunnel handsh -
CVE-2026-105236
TLS 1.2 session resumption in ssl crosses SNI virtual-host c
V. Comments for CVE-2026-55215
No comments yet