Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55215— MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

Quick assessment

Affected
mariadb-corporation mariadb-connector-nodejs
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MariaDB Connector/Node.js 用于将基于 Node.js 开发的应用程序连接到 MariaDB 和 MySQL 数据库。在 3.3.3、3.4.6 和 3.5.3 版本之前，当启用 SSL 且未固定 CA 或服务器证书时，MariaDB Connector/Node.js 会在完成证书指纹验证之前发送凭据。 具体漏洞细节如下： 在 中，如果服务器选择 作为初始身份验证插件，它可以在 TLS 连接后的身份检查完成之前接收到密码。 在 中，身份验证切换逻辑可能会错误地评估之前使用的插件，而非当前请

CVSS 7.5 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
mariadb-corporation mariadb-connector-nodejs < 3.2.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55215

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`
Source: CVE Program / CVE List V5
Vulnerability Description
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing mysql_clear_password to send the credential first. An active man-in-the-middle can present a self-signed certificate, capture the database password, and use it to authenticate directly even though the connector later rejects the server and closes the connection. This issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mariadb-corporation mariadb-connector-nodejs < 3.2.4 -

II. Public POCs for CVE-2026-55215

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55215

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55215 (3)

Vendor Advisories for CVE-2026-55215 (1)

Vendor Pages for CVE-2026-55215 (4)

Other References for CVE-2026-55215 (1)

Same Patch Batch · mariadb-corporation · 2026-08-28 · 8 CVEs total

CVE-2026-55855 6.5 MEDIUM MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/
CVE-2026-55854 5.9 MEDIUM MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficien
CVE-2026-55856 5.9 MEDIUM MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake
CVE-2026-55860 5.9 MEDIUM MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clea
CVE-2026-55859 5.9 MEDIUM MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding o
CVE-2026-55857 5.9 MEDIUM MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Pr
CVE-2026-55858 5.9 MEDIUM MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb

IV. Related Vulnerabilities

Same product: mariadb-connector-nodejs
Same vendor: mariadb-corporation
Same weakness: CWE-295

V. Comments for CVE-2026-55215

No comments yet

Leave a comment