CVE-2026-55856— MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake
Quick assessment
Affected
mariadb-corporation mariadb-connector-j
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MariaDB R2DBC connector是MariaDB基金会的一款关系数据库响应式连接器。 MariaDB R2DBC connector 2.7.14之前版本、3.3.5之前版本、3.4.3之前版本和3.5.9之前版本存在信任管理问题漏洞，该漏洞源于初始握手路径未正确验证证书指纹，在Java应用使用verify-full或verify-ca模式连接时可能接受不受信任的自签名证书，从而允许中间人攻击者获取数据库密码。
Possible ATT&CK Techniques 3 AI
T1012 · Query Registry T1557.001 · Name Resolution Poisoning and SMB Relay T1557 · Adversary-in-the-MiddleAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| mariadb-corporation | mariadb-connector-j | < 2.7.14 |
affected |
>= 3.0.0, < 3.3.5 |
affected | ||
>= 3.4.0, < 3.4.3 |
affected | ||
>= 3.5.0, < 3.5.9 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55856
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake
Source: CVE Program / CVE List V5
Vulnerability Description
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding. The OK-packet and authentication-switch paths enforce the certificate fingerprint, but the initial-handshake path does not. HandshakeResponse.encode() can therefore build and send a mysql_clear_password response before checking certFingerprint != null && !isMitMProof(), sslMode, or whether the authentication plugin is resistant to a man-in-the-middle, and the initial path also bypasses restrictedAuth. An active man-in-the-middle or hostile server can present a self-signed certificate, claim to be MariaDB, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
MariaDB R2DBC connector 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MariaDB R2DBC connector是MariaDB基金会的一款关系数据库响应式连接器。 MariaDB R2DBC connector 2.7.14之前版本、3.3.5之前版本、3.4.3之前版本和3.5.9之前版本存在信任管理问题漏洞，该漏洞源于初始握手路径未正确验证证书指纹，在Java应用使用verify-full或verify-ca模式连接时可能接受不受信任的自签名证书，从而允许中间人攻击者获取数据库密码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mariadb-corporation | mariadb-connector-j | < 2.7.14 | - |
|
II. Public POCs for CVE-2026-55856
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55856
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55856 (2)
Vendor Advisories for CVE-2026-55856 (1)
Vendor Pages for CVE-2026-55856 (3)
-
🔗 [CONJ-1325] initial-handshake cleartext password leak - Jira x_refsource_MISC
-
-
Other References for CVE-2026-55856 (1)
-
🔗 Sign in | HackerOne x_refsource_MISC
Same Patch Batch · mariadb-corporation · 2026-08-28 · 8 CVEs total
| CVE-2026-55215 | 7.5 HIGH | MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: |
| CVE-2026-55855 | 6.5 MEDIUM | MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/ |
| CVE-2026-55854 | 5.9 MEDIUM | MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficien |
| CVE-2026-55860 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clea |
| CVE-2026-55859 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding o |
| CVE-2026-55857 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Pr |
| CVE-2026-55858 | 5.9 MEDIUM | MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb |
IV. Related Vulnerabilities
Same vendor: mariadb-corporation
-
CVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protoco -
CVE-2026-107384
MariaDB Connector/Node.js: SQL injection through object keys -
CVE-2026-107383
MariaDB Connector/Node.js exposes uninitialized process memo -
CVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the cl -
CVE-2026-61700
MariaDB Connector/J does not enforce allowLocalInfile=false
Same weakness: CWE-522
-
CVE-2026-104617
sdbootutil: qrencode invocation leaks PIN/recovery key in /p -
CVE-2026-102944
cpp-httplib: Cookie header leaked on cross-origin redirect -
CVE-2026-63160
Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token -
CVE-2026-109953
FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure -
CVE-2026-108904
pH7Builder before 18.5.0 Sensitive Data Exposure via Member
V. Comments for CVE-2026-55856
No comments yet