CVE-2026-55857: MariaDB Connector/J Password Disclosure

CVE-2026-55857 Overview

CVE-2026-55857 is a cleartext transmission vulnerability [CWE-319] in MariaDB Connector/J, the JDBC driver used by Java applications to connect to MariaDB and MySQL databases. Prior to versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the driver's PAM dialog authentication handler fails to declare a secure-transport requirement. A hostile or man-in-the-middle server can issue an Authentication Switch Request for the dialog plugin over plain TCP. The driver responds by transmitting the user's password in cleartext when sslMode=DISABLE and restrictedAuth=null, which is the default configuration.

Critical Impact
An attacker positioned between a Java application and a MariaDB/MySQL server can coerce the JDBC driver into disclosing database account passwords in plaintext over unencrypted TCP connections.

Affected Products

MariaDB Connector/J versions prior to 2.7.14 (2.x branch)
MariaDB Connector/J versions prior to 3.3.5, 3.4.3, and 3.5.9 (3.x branch)
Java applications connecting to MariaDB or MySQL with sslMode=DISABLE and default restrictedAuth

Discovery Timeline

2026-08-28 - CVE-2026-55857 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55857

Vulnerability Analysis

The MariaDB Connector/J driver supports multiple authentication plugins. Plugins that transmit secrets in cleartext are supposed to be gated behind a secure transport check. The mysql_clear_password plugin correctly declares requireSsl() and refuses to run over plain TCP. However, the sibling handler SendPamAuthPacketFactory, registered under the plugin name dialog, inherits the default requireSsl() value of false. Older 2.x branches implement the same flaw in SendPamAuthPacket.

Because a MySQL/MariaDB server can request an authentication plugin switch mid-handshake, a rogue or intercepting server can send an Authentication Switch Request naming dialog. The client accepts the switch and returns the password without checking whether the underlying socket is TLS-protected. Properly verified TLS sessions and local Unix domain sockets are not exposed to this transport vector.

Root Cause

The AuthenticationPluginFactory interface exposed requireSsl() with a default return value of false. The PAM dialog plugin never overrode that default. The plugin dispatch logic in StandardClient only consulted this flag, so a plugin that failed to declare its requirement was executed over any transport.

Attack Vector

Exploitation requires a network position that allows the attacker to act as, or intercept and modify traffic to, the database server. The attacker sends an Authentication Switch Request selecting the dialog plugin over the plaintext TCP handshake, and the driver responds with the account password in the clear.

java

// Patch in src/main/java/org/mariadb/jdbc/plugin/authentication/standard/SendPamAuthPacket.java
// [CONJ-1320] PAM (dialog) authentication must require a secure connection
    return "dialog";
  }

+  @Override
+  public boolean requireSsl() {
+    // PAM ("dialog") sends the password to the server in clear text, exactly like
+    // mysql_clear_password. It must therefore only run over a secure channel (TLS, or a local
+    // unix socket - handled by the dispatcher).
+    return true;
+  }
+
  /**
   * Initialization.
   *

Source: MariaDB Connector/J commit a8599ab

java

// Patch in src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java
// Dispatcher now also refuses cleartext plugins on non-TLS, non-unix-socket transports
           AuthSwitchPacket authSwitchPacket = AuthSwitchPacket.decode(buf);
           AuthenticationPluginFactory authPluginFactory =
               AuthenticationPluginLoader.get(authSwitchPacket.getPlugin(), conf);
-          if (authPluginFactory.requireSsl() && !context.hasClientCapability(SSL)) {
+          if (authPluginFactory.requireSecure()
+              && !context.hasClientCapability(SSL)
+              && !(socket instanceof UnixDomainSocket)) {
             throw context
                 .getExceptionFactory()
                 .create(
                     "Cannot use authentication plugin "
                         + authPluginFactory.type()
-                        + " if SSL is not enabled.",
+                        + " if SSL is not enabled (a clear-text password plugin requires TLS or a"
+                        + " local unix socket).",
                     "08000");
           }

Source: MariaDB Connector/J commit f4a727c

Detection Methods for CVE-2026-55857

Indicators of Compromise

Java applications using MariaDB Connector/J with JDBC URLs containing sslMode=DISABLE or no sslMode parameter
MySQL/MariaDB protocol handshakes containing an Authentication Switch Request to the dialog plugin over unencrypted TCP
Unexpected authentication plugin negotiations from database servers not configured for PAM authentication
Database credentials appearing in packet captures of client-server traffic

Detection Strategies

Inventory JDBC dependencies via build manifests (pom.xml, build.gradle) and flag mariadb-java-client versions below 2.7.14, 3.3.5, 3.4.3, or 3.5.9
Inspect application configuration and connection pool settings for sslMode=DISABLE or missing TLS parameters
Perform network-level monitoring for MySQL protocol frames containing plugin name dialog on non-TLS ports
Correlate outbound database connections against an allowlist of expected server endpoints to detect redirection to attacker infrastructure

Monitoring Recommendations

Log JDBC driver versions at application startup and forward them to a centralized log store for version-drift detection
Alert on MySQL/MariaDB connections that complete authentication without a TLS handshake preceding credential exchange
Monitor DNS and ARP anomalies on network segments that carry database traffic to detect man-in-the-middle positioning

How to Mitigate CVE-2026-55857

Immediate Actions Required

Upgrade MariaDB Connector/J to version 2.7.14, 3.3.5, 3.4.3, or 3.5.9 as appropriate for the deployed branch
Enforce sslMode=VERIFY_FULL in all JDBC connection strings so certificate validation prevents impersonation
Rotate database account passwords that may have traversed untrusted networks with a vulnerable driver
Restrict restrictedAuth in the connection configuration to the specific authentication plugins actually required by the deployment

Patch Information

MariaDB Corporation released fixed builds tagged MariaDB Connector/J 3.4.3 and MariaDB Connector/J 3.5.9, with equivalent fixes backported to 3.3.5 and 2.7.14. The fix declares requireSecure() (renamed from requireSsl() in the 3.x branches) for the PAM dialog plugin, and the dispatcher now treats a local Unix domain socket as an acceptable secure transport. See the MariaDB Security Advisory GHSA-qxvw-fvwx-5cp7 and tracking issue CONJ-1320.

Workarounds

Set sslMode=VERIFY_FULL on every JDBC URL and provision the server's CA certificate on all clients
Explicitly set restrictedAuth to exclude dialog where PAM authentication is not required
Route database traffic exclusively over local Unix domain sockets or mutually authenticated TLS tunnels until patching completes

bash

# Example hardened JDBC URL enforcing full TLS verification
jdbc:mariadb://db.example.internal:3306/appdb?\
sslMode=VERIFY_FULL&\
serverSslCert=/etc/ssl/certs/mariadb-ca.pem&\
restrictedAuth=mysql_native_password,caching_sha2_password