CVE-2026-55854: MariaDB Connector/Node.js Password Disclosure

CVE-2026-55854 Overview

CVE-2026-55854 is a cleartext transmission vulnerability [CWE-319] affecting the MariaDB Connector/Node.js library. The connector fails to enforce a secure-transport requirement for the server-side dialog (PAM) authentication plugin. When sslMode=DISABLE and restrictedAuth=null are set (the defaults), a malicious or on-path server can send an Authentication Switch Request to the dialog plugin over plain TCP. The connector responds by sending the account password in cleartext. The flaw resides in lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js. It is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

Critical Impact
An attacker capable of impersonating or intercepting a MariaDB/MySQL server over the network can coerce vulnerable Node.js clients to disclose database account passwords in plaintext.

Affected Products

MariaDB Connector/Node.js versions prior to 3.2.4
MariaDB Connector/Node.js 3.3.x prior to 3.3.3, and 3.4.x prior to 3.4.6
MariaDB Connector/Node.js 3.5.x prior to 3.5.3

Discovery Timeline

2026-08-28 - CVE-2026-55854 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55854

Vulnerability Analysis

MariaDB Connector/Node.js supports multiple client authentication plugins negotiated during the handshake. The mysql_clear_password plugin already gated its execution behind a secure transport check because it transmits credentials in plaintext. The dialog plugin (used by PAM authentication) implements the same wire behavior but did not inherit that gate.

During connection setup, the server can respond with an Authentication Switch Request naming an arbitrary plugin. When the connector received a switch to dialog over an unencrypted TCP socket, it invoked SendPamAuthPacketFactory and returned opts.password unencrypted. This exposes any credential passed to createConnection() to a network-positioned adversary or a rogue server. Fingerprint-only server identity validation does not stop the attack because the disclosure occurs before mutual identity is verified.

Root Cause

The dialog plugin handler in pam-password-auth.js inherited from the clear-password base class but overrode or omitted the requireSsl() / requireSecure() predicate. The handshake dispatcher in authentication.js therefore skipped the transport check for dialog while enforcing it for mysql_clear_password.

Attack Vector

An attacker requires an on-path position, DNS or routing control, or the ability to operate a hostile MariaDB/MySQL server that a client will connect to. With the default sslMode=DISABLE, the attacker completes the initial handshake, issues an Authentication Switch Request for dialog, and receives the account password in cleartext in the following packet.

javascript

// Patch: lib/cmd/handshake/auth/clear-password-auth.js
// Source: https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/53b304264df84496d331dba2765c3634602f342e
    this.multiAuthResolver = multiAuthResolver;
  }

-  requireSsl() {
+  requireSecure() {
    return true;
  }

// Patch: lib/cmd/handshake/auth/handshake.js
    ClientCapabilities(opts, info);
    this.pluginName = handshake.pluginName;

-    if (this.requireSsl() && !this.isSecureConnection(opts)) {
+    if (this.requireSecure() && !this.isSecureConnection(opts)) {
      return this.throwNewError(
        `${this.pluginName} authentication requires TLS or a local socket`,
        true,

The rename from requireSsl() to requireSecure() generalizes the check so that both mysql_clear_password and dialog plugins refuse to send credentials unless the transport is TLS or a local Unix socket. See the MariaDB Security Advisory GHSA-42r5-vhpq-m858 for the full write-up.

Detection Methods for CVE-2026-55854

Indicators of Compromise

Outbound MariaDB/MySQL sessions (TCP/3306) from Node.js application hosts that lack a TLS ClientHello record immediately after the server greeting.
MariaDB handshake packets containing an Authentication Switch Request naming the dialog plugin over cleartext connections.
Application logs showing successful authentications to unexpected or newly resolved database endpoints.

Detection Strategies

Inventory Node.js applications and identify dependency versions of mariadb via npm ls mariadb or SBOM data, flagging any version below 3.2.4, 3.3.3, 3.4.6, or 3.5.3.
Alert on database connection strings or runtime options where sslMode is DISABLE or unset and restrictedAuth is null.
Inspect east-west network flows for MariaDB handshakes that negotiate dialog authentication without a preceding STARTTLS upgrade.

Monitoring Recommendations

Monitor for DNS changes, ARP anomalies, or unexpected route updates on segments carrying database traffic.
Log and review MariaDB general_log or audit plugin events for authentication plugin switches on production accounts.
Track credential rotation events after suspected exposure windows on any account used by vulnerable connector versions.

How to Mitigate CVE-2026-55854

Immediate Actions Required

Upgrade the mariadb npm package to 3.2.4, 3.3.3, 3.4.6, or 3.5.3 depending on the release line in use.
Rotate database account passwords that were used by vulnerable clients over untrusted networks.
Set sslMode to VERIFY_FULL (or use a local Unix socket) for all production connections and pin trusted CAs.

Patch Information

MariaDB Corporation released fixes across four supported branches: 3.2.4, 3.3.3, 3.4.6, and 3.5.3. The corresponding fix commits generalize the secure-transport check to cover any plugin that transmits credentials in plaintext, including dialog. Tracking issue: CONJS-353.

Workarounds

Set restrictedAuth to an allow-list that excludes dialog and mysql_clear_password, blocking those plugins from being negotiated.
Enforce TLS with certificate verification via sslMode: 'VERIFY_FULL' and a pinned ca bundle, so a hostile server cannot complete the handshake.
Where possible, connect to the database over a local Unix socket rather than TCP to eliminate the on-path attack surface.

bash

# Upgrade the vulnerable dependency
npm install mariadb@^3.5.3   # or 3.4.6 / 3.3.3 / 3.2.4 per branch

# Example hardened connection options
node -e "require('mariadb').createConnection({
  host: 'db.internal',
  user: 'app',
  password: process.env.DB_PASS,
  sslMode: 'VERIFY_FULL',
  ssl: { ca: require('fs').readFileSync('/etc/ssl/ca.pem') },
  restrictedAuth: ['mysql_native_password', 'caching_sha2_password']
});"