CVE-2026-55860— MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Quick assessment
Affected
mariadb-corporation mariadb-connector-r2dbc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MariaDB Connector/R2DBC 是一个用 Java 实现的非阻塞 MariaDB 和 MySQL 客户端。在 1.4.1 版本之前，org.mariadb:r2dbc-mariadb 未对明文密码认证插件根据传输层加密情况进行限制，因为 AuthenticationPlugin 接口没有提供任何机制让插件能够要求使用安全连接。一个恶意的或处于中间人位置的 MariaDB 服务器可以通过未加密的纯 TCP 连接发送一个 AuthSwitchRequest，其中指定使用 mysql_clear_pass
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55860
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Source: CVE Program / CVE List V5
Vulnerability Description
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文传输
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mariadb-corporation | mariadb-connector-r2dbc | < 1.4.1 | - |
|
| org.mariadb | r2dbc-mariadb | < 1.4.1 | - |
|
II. Public POCs for CVE-2026-55860
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55860
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55860 (1)
Vendor Advisories for CVE-2026-55860 (1)
Security Blog Posts for CVE-2026-55860 (1)
-
🔗 [R2DBC-115] Cleartext password leak for MiTm server - Jira x_refsource_MISC
Other References for CVE-2026-55860 (2)
-
🔗 Sign in | HackerOne x_refsource_MISC
-
Same Patch Batch · mariadb-corporation · 2026-08-28 · 8 CVEs total
| CVE-2026-55215 | 7.5 HIGH | MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: |
| CVE-2026-55855 | 6.5 MEDIUM | MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/ |
| CVE-2026-55854 | 5.9 MEDIUM | MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficien |
| CVE-2026-55856 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake |
| CVE-2026-55859 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding o |
| CVE-2026-55857 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Pr |
| CVE-2026-55858 | 5.9 MEDIUM | MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb |
IV. Related Vulnerabilities
Same vendor: mariadb-corporation
-
CVE-2026-55859
MariaDB Connector/R2DBC: Inappropriate Encoding for Output C -
CVE-2026-55858
MariaDB Connector/J: Inappropriate Encoding for Output Conte -
CVE-2026-55857
MariaDB Connector/J: Cleartext Transmission of Sensitive Inf -
CVE-2026-55856
MariaDB Connector/J: Cleartext password disclosure to a MITM -
CVE-2026-55855
MariaDB Connector/Node.js: Possible SQL injection in Buffer
Same weakness: CWE-319
-
CVE-2026-55857
MariaDB Connector/J: Cleartext Transmission of Sensitive Inf -
CVE-2026-55854
MariaDB Connector/Node.js: Cleartext Transmission of Sensiti -
CVE-2026-69658
Ebyte NE2-D11 Cleartext Transmission of Sensitive Informatio -
CVE-2026-73809
Ebyte NE2-D11 Cleartext Transmission of Sensitive Informatio -
CVE-2026-81836
RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transm
V. Comments for CVE-2026-55860
No comments yet