CVE-2026-107819: MariaDB Connector/C SSL Auth Vulnerability

CVE-2026-107819 Overview

CVE-2026-107819 is a certificate validation flaw [CWE-297] in MariaDB Connector/C affecting versions 3.4.1 through 3.4.9. The Zero-Configuration SSL authentication-switch logic in libmariadb verified certificate trust but failed to reject a Transport Layer Security (TLS) hostname mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker holding a valid certificate for any other hostname can request mysql_clear_password and capture the database password in cleartext inside the attacker-controlled TLS session. Other MariaDB connectors are not affected. The issue is fixed in version 3.4.10.

Critical Impact
Active network attackers can intercept MariaDB client connections and obtain cleartext database credentials by abusing the auth-switch flow with a valid certificate issued for an unrelated hostname.

Affected Products

MariaDB Connector/C libmariadb versions 3.4.1 through 3.4.9
Applications linking against vulnerable libmariadb C/C++ client library
MariaDB/MySQL client workflows using Zero-Configuration SSL

Discovery Timeline

2026-10-09 - CVE-2026-107819 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-107819

Vulnerability Analysis

MariaDB Connector/C supports a Zero-Configuration SSL mode where the client opportunistically negotiates TLS without preloaded certificate authority (CA) material. During authentication-plugin negotiation, the connector consulted the certificate trust result but did not consult the hostname verification result. As a consequence, a server presenting a TLS certificate valid for an unrelated domain could still progress the handshake far enough to drive the auth-switch logic.

Once in that state, the server can request the mysql_clear_password plugin. This plugin transmits the user's password in cleartext inside the TLS tunnel. Because the TLS peer is attacker-controlled, the attacker reads the credential directly.

Root Cause

The defect is an improper certificate validation issue [CWE-297]. The FIX_SSL_VERIFY_SERVER_CERT path and the invalid-cert gating logic in libmariadb/ma_tls.c did not require hostname verification before accepting a non-hashing authentication plugin. Additional certificate options such as ssl_crl, ssl_crlpath, ssl_ca, and ssl_capath were not factored into the skip-verification condition.

Attack Vector

Exploitation requires an active man-in-the-middle position on the network path between the client and the MariaDB server. The attacker must also possess any valid certificate chaining to a CA the client trusts, even for an unrelated hostname. The attacker terminates the TLS session, forces the auth-switch to mysql_clear_password, and captures the cleartext password. User interaction is not required.

// Security patch in libmariadb/ma_tls.c — CONC-846
// Source: https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02

/* Skip peer certificate verification */
if (mysql->options.extension->tls_allow_invalid_server_cert &&
-    (!mysql->options.extension->tls_fp && !mysql->options.extension->tls_fp_list))
+    (!mysql->options.extension->tls_fp &&
+     !mysql->options.extension->tls_fp_list &&
+     !mysql->options.extension->ssl_crl &&
+     !mysql->options.extension->ssl_crlpath &&
+     !mysql->options.ssl_ca &&
+     !mysql->options.ssl_capath))
{
  /* Since OpenSSL implementation sets status during TLS handshake
     we need to clear verification status */

A companion change in libmariadb/mariadb_lib.c ensures the server-certificate verification flag is initialized consistently during client setup via FIX_SSL_VERIFY_SERVER_CERT(&mysql->options);.

Detection Methods for CVE-2026-107819

Indicators of Compromise

Unexpected use of the mysql_clear_password authentication plugin from clients that normally negotiate hashed plugins such as mysql_native_password or caching_sha2_password.
TLS sessions to database endpoints presenting certificates whose Subject Alternative Name does not match the configured database hostname.
Database authentication events originating from unexpected intermediate IP addresses or proxies on the client-server path.

Detection Strategies

Inventory applications linking against libmariadb and flag binaries bundling versions 3.4.1 through 3.4.9.
Enable server-side logging of the chosen authentication plugin per connection and alert on mysql_clear_password outside of approved use cases.
Inspect network telemetry for TLS handshakes where the server certificate's CommonName or SAN does not match the resolved MariaDB hostname.

Monitoring Recommendations

Centralize MariaDB and application connection logs and correlate plugin selection with client version strings.
Alert on any configuration that sets tls_allow_invalid_server_cert in production application code.
Watch for credential-reuse anomalies and failed authentications that follow suspicious TLS renegotiations.

How to Mitigate CVE-2026-107819

Immediate Actions Required

Upgrade MariaDB Connector/C to version 3.4.10 across all application hosts and container images.
Rotate database passwords for any account that may have authenticated through a potentially intercepted path.
Disable the mysql_clear_password plugin on client and server where it is not explicitly required.

Patch Information

The fix is included in MariaDB Connector/C 3.4.10. See the GitHub Security Advisory GHSA-fmq9-qjxj-qpf7, the upstream commit e8c0a16d, the v3.4.10 release notes, and the MariaDB JIRA issue CONC-846.

Workarounds

Explicitly configure a trusted CA bundle with ssl_ca or ssl_capath so Zero-Configuration SSL is not used.
Enforce TLS fingerprint pinning via tls_fp or tls_fp_list for critical database connections.
Restrict database access to trusted network segments and require mutual TLS where feasible.

bash

# Example client configuration enforcing CA validation and disabling cleartext auth
[client]
ssl-ca=/etc/ssl/certs/mariadb-ca.pem
ssl-verify-server-cert=ON
enable-cleartext-plugin=OFF