CVE-2026-55215: MariaDB Connector/Node.js Credential Leak

CVE-2026-55215 Overview

CVE-2026-55215 is a certificate validation flaw [CWE-295] in MariaDB Connector/Node.js. The connector transmits credentials before completing TLS certificate fingerprint validation when ssl is enabled without a pinned certificate authority (CA) or server certificate. An active man-in-the-middle (MitM) can present a self-signed certificate and capture the database password in cleartext. The connector later rejects the server, but the credential has already been leaked. Versions prior to 3.3.3, 3.4.6, and 3.5.3 are affected. The issue is tracked as GHSA-cqhc-2h57-wpxf and MariaDB JIRA CONJS-349.

Critical Impact
An on-path attacker can capture cleartext MariaDB/MySQL credentials during TLS handshake and reuse them to authenticate directly against the real database server.

Affected Products

MariaDB Connector/Node.js versions prior to 3.3.3
MariaDB Connector/Node.js 3.4.x prior to 3.4.6
MariaDB Connector/Node.js 3.5.x prior to 3.5.3

Discovery Timeline

2026-08-28 - CVE-2026-55215 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-55215

Vulnerability Analysis

The flaw is an improper certificate validation issue [CWE-295] in the connector's TLS handshake sequence. When applications enable ssl but do not pin a CA or server certificate, the connector relies on fingerprint validation performed after authentication messages are sent. This ordering violates the trust-before-secrets principle.

The vulnerable logic lives in two files. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin receives the password before the post-TLS identity check runs. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin. This lets mysql_clear_password send the credential first even when a stronger plugin is expected.

Root Cause

The connector's permitHash() method in plugin-auth.js returned true for the base plugin class, indicating that any plugin could send credentials before fingerprint verification. Combined with the plugin-switch evaluation bug, this allowed cleartext passwords to leave the client during a TLS session with an untrusted peer.

Attack Vector

An attacker positioned on the network path between the Node.js application and the MariaDB/MySQL server intercepts the TLS handshake. The attacker presents a self-signed certificate to the client. The connector completes the TLS session, negotiates mysql_clear_password, and transmits the password. The attacker records the credential, then uses it to authenticate directly to the real database server. The client eventually rejects the fingerprint and closes the connection, but the credential has already been exfiltrated.

javascript

// Patch in lib/cmd/handshake/auth/handshake.js (commit 514576a)
const serverCert = secureSocket.getPeerCertificate(false);
info.tlsCert = serverCert;
info.tlsFingerprint = serverCert ? serverCert.fingerprint256.replace(/:/gi, '').toLowerCase() : null;

if (info.requireValidCert && info.selfSignedCertificate && Boolean(opts.password) && !this.permitHash()) {
  return this.throwNewError(
    `Unsupported authentication plugin ${this.pluginName} with Self signed certificates.
     Either set 'ssl: { rejectUnauthorized: false }' (trust mode) or provide server certificate to client`,
    true,
    info,
    '08000',
    Errors.client.ER_SELF_SIGNED_BAD_PLUGIN
  );
}

Handshake.send.call(this, this, out, opts, handshake.pluginName, info);

// Patch in lib/cmd/handshake/auth/plugin-auth.js
permitHash() {
  return false;   // was: return true;
}

Source: MariaDB Commit 514576a

Detection Methods for CVE-2026-55215

Indicators of Compromise

Unexpected TLS sessions from Node.js application hosts terminating at non-database IPs on port 3306.
Database authentication events using mysql_clear_password where the source IP does not match the sanctioned application tier.
Repeated short-lived TLS connections from application servers that end with client-side certificate rejection errors.
Presence of self-signed or unknown-issuer certificates in TLS handshakes observed on database routes.

Detection Strategies

Inventory Node.js applications using mariadb npm package and flag versions below 3.3.3, 3.4.6, or 3.5.3.
Alert on database logins that use the mysql_clear_password plugin against MariaDB/MySQL servers.
Inspect TLS metadata on database traffic for certificate subject/issuer mismatches and self-signed certificates.

Monitoring Recommendations

Enable MariaDB/MySQL general query and connection logs; forward authentication plugin and source IP fields to your SIEM.
Monitor egress from application subnets to database CIDRs for TLS sessions terminating at unexpected endpoints.
Track application logs for ER_SELF_SIGNED_BAD_PLUGIN (SQLSTATE 08000) after patching to identify misconfigured or attacked clients.

How to Mitigate CVE-2026-55215

Immediate Actions Required

Upgrade MariaDB Connector/Node.js to 3.3.3, 3.4.6, or 3.5.3 or later depending on the branch in use.
Rotate database passwords for any accounts used by Node.js applications that connected without a pinned certificate.
Pin a CA or server certificate via the ssl option so identity is verified before authentication plugins run.
Disable mysql_clear_password on database servers unless required, and never over untrusted networks.

Patch Information

Fixes were released in MariaDB Connector/Node.js 3.3.3, 3.4.6, and 3.5.3. The relevant commits are 514576a, c47d727, and ecd3695. See the GHSA-cqhc-2h57-wpxf advisory and HackerOne Report #3777370 for full details.

Workarounds

Provide an explicit server certificate or CA in the ssl configuration so rejectUnauthorized and fingerprint validation happen against a pinned trust anchor.
Restrict database network paths to private links or mutual TLS to reduce MitM exposure until patches are deployed.
Configure database accounts to require a hash-based plugin (for example, caching_sha2_password or mysql_native_password) rather than mysql_clear_password.

bash

# Upgrade the connector to a patched version
npm install mariadb@^3.5.3

# Example: pin the server certificate so identity is verified before auth
# Node.js application configuration
node -e "const mariadb = require('mariadb'); \
const fs = require('fs'); \
mariadb.createConnection({ \
  host: 'db.internal.example', \
  user: 'app', \
  password: process.env.DB_PASS, \
  ssl: { ca: fs.readFileSync('/etc/ssl/mariadb-ca.pem'), rejectUnauthorized: true } \
});"