CVE-2026-55860: MariaDB Connector/R2DBC Information Disclosure

CVE-2026-55860 Overview

CVE-2026-55860 affects MariaDB Connector/R2DBC, a non-blocking MariaDB and MySQL client implemented in Java. Versions prior to 1.4.1 fail to gate cleartext password authentication plugins on transport encryption. The AuthenticationPlugin interface lacks any capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP connection. The client then returns the user's password as cleartext bytes on the wire, allowing an attacker to reuse those credentials against the database. The issue is classified as [CWE-319] Cleartext Transmission of Sensitive Information.

Critical Impact
An on-path attacker can coerce the R2DBC client into disclosing database credentials in cleartext, enabling direct authentication to the MariaDB or MySQL server.

Affected Products

org.mariadb:r2dbc-mariadb versions prior to 1.4.1
Java applications using MariaDB Connector/R2DBC for non-blocking MariaDB access
Java applications using MariaDB Connector/R2DBC for non-blocking MySQL access

Discovery Timeline

2026-08-28 - CVE-2026-55860 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55860

Vulnerability Analysis

MariaDB Connector/R2DBC supports several authentication plugins negotiated dynamically with the server. Two of these plugins, ClearPasswordPluginFlow (mysql_clear_password) and PamPluginFlow (dialog), transmit the user's password as cleartext bytes. The connector implements the AuthenticationPlugin interface without any method to declare that a plugin requires transport security. As a result, AuthenticationFlow accepts a server-issued AuthSwitchRequest for these plugins regardless of whether the socket is protected by TLS.

An attacker positioned between the client and the database server, or operating a rogue MariaDB endpoint, can force this authentication switch. The client complies, writing the plaintext password onto an unencrypted TCP stream. The attacker captures the credential and reuses it to authenticate directly to the legitimate database.

Root Cause

The root cause is missing enforcement of a security precondition in the plugin negotiation logic. The AuthenticationPlugin interface exposed no requireSecure() capability, so AuthenticationFlow had no basis to reject cleartext plugins over plain TCP. The plugin design trusted the server to only request cleartext authentication when appropriate, violating the principle that clients must independently protect secrets in transit.

Attack Vector

Exploitation requires a network position that lets the attacker either impersonate the database server or intercept and modify traffic to it. The attacker responds to the client handshake with an AuthSwitchRequest selecting mysql_clear_password or dialog. When the client uses a plain-TCP connection string without enforced TLS, the connector emits the cleartext password. The disclosed credential is then usable for direct authentication against the real database server.

java

// Patch: src/main/java/org/mariadb/r2dbc/authentication/AuthenticationPlugin.java
// Adds capability for a plugin to require transport security.

  AuthenticationPlugin create();

+ /**
+  * Whether this authentication plugin requires a secure connection (TLS or a local unix socket).
+  * Plugins that transmit the password in clear text return {@code true}; the driver then refuses
+  * to run them over a plain TCP connection, so a malicious server cannot harvest the password by
+  * requesting a clear-text authentication plugin.
+  *
+  * @return true if a secure connection is required
+  */
+ default boolean requireSecure() {
+   return false;
+ }

  ClientMessage next(
      MariadbConnectionConfiguration configuration,
      byte[] seed,

// Patch: src/main/java/org/mariadb/r2dbc/authentication/addon/ClearPasswordPluginFlow.java
// ClearPasswordPluginFlow now declares it requires a secure connection.

    return TYPE;
  }

+ @Override
+ public boolean requireSecure() {
+   return true;
+ }

  public ClientMessage next(
      MariadbConnectionConfiguration configuration,
      byte[] seed,

Source: GitHub Commit be786603

Detection Methods for CVE-2026-55860

Indicators of Compromise

Plain-TCP MariaDB or MySQL sessions where the server initiates an AuthSwitchRequest for mysql_clear_password or dialog (PAM).
Unexpected outbound connections from Java application hosts to database endpoints outside the approved database subnet.
Successful database authentications from source IPs or user agents that do not match approved application service identities.

Detection Strategies

Inspect application dependency manifests for org.mariadb:r2dbc-mariadb at versions below 1.4.1.
Monitor MariaDB and MySQL protocol traffic for authentication-plugin switch packets referencing cleartext or PAM dialog plugins on non-TLS sessions.
Correlate database logon events with expected client identities and TLS session metadata to spot connections that skipped encryption.

Monitoring Recommendations

Enable MariaDB and MySQL audit logging for authentication events and forward records to a centralized analytics platform for correlation.
Alert when a database account authenticates from a host outside its documented allowlist of application servers.
Track TLS enforcement metrics on database listeners and alert on any successful non-TLS connections from application tiers.

How to Mitigate CVE-2026-55860

Immediate Actions Required

Upgrade org.mariadb:r2dbc-mariadb to version 1.4.1 or later across all Java services.
Enforce TLS on every MariaDB and MySQL listener that accepts application traffic and disable plaintext-only listeners.
Rotate database credentials for any account whose R2DBC client may have connected over plain TCP while a vulnerable version was in use.

Patch Information

The fix is available in MariaDB Connector/R2DBC 1.4.1. The patch introduces a requireSecure() capability on the AuthenticationPlugin interface and marks ClearPasswordPluginFlow and PamPluginFlow as requiring a secure transport. The driver now refuses to execute these plugins over an unencrypted TCP connection. See the GitHub Release 1.4.1 and GitHub Security Advisory GHSA-c857-9x2m-cvh2 for full details.

Workarounds

Configure R2DBC connection URLs to require TLS by setting sslMode=verify-full (or equivalent) and providing a validated server certificate authority.
Restrict database network exposure to trusted subnets and enforce mutual TLS between application services and database endpoints.
Disable server-side support for mysql_clear_password and PAM dialog authentication for accounts that do not require them.

bash

# Update Maven dependency to the patched version
mvn versions:use-dep-version -Dincludes=org.mariadb:r2dbc-mariadb -DdepVersion=1.4.1 -DforceVersion=true

# Or update Gradle build.gradle
# implementation 'org.mariadb:r2dbc-mariadb:1.4.1'

# Enforce TLS on the R2DBC connection URL
# r2dbc:mariadb://db.example.internal:3306/appdb?sslMode=verify-full&serverSslCert=/etc/ssl/certs/db-ca.pem