CVE-2026-55860— MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Quick assessment
Affected
mariadb-corporation mariadb-connector-r2dbc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MariaDB R2DBC connector是MariaDB基金会的一款关系数据库响应式连接器。 MariaDB R2DBC connector 1.4.1之前版本存在安全漏洞，该漏洞源于AuthenticationPlugin接口无法要求安全连接，导致明文密码认证插件未与传输加密绑定，恶意或中间人MariaDB服务器可通过未加密的TCP连接发送AuthSwitchRequest，使AuthenticationFlow返回用户明文密码，造成凭据泄露。
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-MiddleAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| mariadb-corporation | mariadb-connector-r2dbc | < 1.4.1 |
affected |
| org.mariadb | r2dbc-mariadb | < 1.4.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55860
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Source: CVE Program / CVE List V5
Vulnerability Description
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文传输
Source: CVE Program / CVE List V5
Vulnerability Title
MariaDB R2DBC connector 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MariaDB R2DBC connector是MariaDB基金会的一款关系数据库响应式连接器。 MariaDB R2DBC connector 1.4.1之前版本存在安全漏洞，该漏洞源于AuthenticationPlugin接口无法要求安全连接，导致明文密码认证插件未与传输加密绑定，恶意或中间人MariaDB服务器可通过未加密的TCP连接发送AuthSwitchRequest，使AuthenticationFlow返回用户明文密码，造成凭据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mariadb-corporation | mariadb-connector-r2dbc | < 1.4.1 | - |
|
| org.mariadb | r2dbc-mariadb | < 1.4.1 | - |
|
II. Public POCs for CVE-2026-55860
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55860
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55860 (1)
Vendor Advisories for CVE-2026-55860 (1)
Security Blog Posts for CVE-2026-55860 (1)
-
🔗 [R2DBC-115] Cleartext password leak for MiTm server - Jira x_refsource_MISC
Other References for CVE-2026-55860 (2)
-
🔗 Sign in | HackerOne x_refsource_MISC
-
Same Patch Batch · mariadb-corporation · 2026-08-28 · 8 CVEs total
| CVE-2026-55215 | 7.5 HIGH | MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: |
| CVE-2026-55855 | 6.5 MEDIUM | MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/ |
| CVE-2026-55854 | 5.9 MEDIUM | MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficien |
| CVE-2026-55856 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake |
| CVE-2026-55859 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding o |
| CVE-2026-55857 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Pr |
| CVE-2026-55858 | 5.9 MEDIUM | MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb |
IV. Related Vulnerabilities
Same vendor: mariadb-corporation
-
CVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protoco -
CVE-2026-107384
MariaDB Connector/Node.js: SQL injection through object keys -
CVE-2026-107383
MariaDB Connector/Node.js exposes uninitialized process memo -
CVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the cl -
CVE-2026-61700
MariaDB Connector/J does not enforce allowLocalInfile=false
Same weakness: CWE-319
-
CVE-2026-15102
Cleartext Transmission of Sensitive Information in ADP Deskt -
CVE-2026-92832
IBM Aspera Enterprise Webapps Information Disclosure -
CVE-2026-85975
Cleartext transmission in Progress MarkLogic Server Amazon S -
CVE-2026-85973
Cleartext transmission in Progress MarkLogic Server cluster -
CVE-2026-108716
mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmi
V. Comments for CVE-2026-55860
No comments yet