DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55854: CVE-2026-55854: Cleartext Credential Disclosure in MariaDB Connector/Node.js via Coerced Authentication Switch

#security #cve #cybersecurity

CVE-2026-55854: Cleartext Credential Disclosure in MariaDB Connector/Node.js via Coerced Authentication Switch

Vulnerability ID: CVE-2026-55854
CVSS Score: 5.9
Published: 2026-08-28

CVE-2026-55854 identifies a critical security flaw in the MariaDB Connector for Node.js (mariadb npm package). When establishing connections, the driver fails to validate transport security requirements during Pluggable Authentication Modules (PAM) dialog authentication. This vulnerability allows active on-path attackers or malicious database servers to coerce the client driver into transmitting user credentials in cleartext over unencrypted TCP connections.

TL;DR

The MariaDB Connector for Node.js fails to verify TLS or local transport security before performing PAM dialog authentication, allowing on-path attackers to capture database passwords in cleartext.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-319, CWE-522
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 5.9 (Medium)
  • EPSS Score: 0.00278
  • Impact: High Confidentiality Compromise (Credential Disclosure)
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • MariaDB Connector/Node.js (mariadb npm package)
  • mariadb: < 3.2.4 (Fixed in: 3.2.4)
  • mariadb: >= 3.3.0, < 3.3.3 (Fixed in: 3.3.3)
  • mariadb: >= 3.4.0, < 3.4.6 (Fixed in: 3.4.6)
  • mariadb: >= 3.5.0, < 3.5.3 (Fixed in: 3.5.3)

Code Analysis

Commit: 2973340

Fix: require secure connection for PAM authentication

Commit: 53b3042

Ensure secure connection conditions are met in plugin validation

Commit: 9781de6

Rename requireSsl to requireSecure and support local sockets

Commit: fbc159c

Enforce secure check inside handshake.js for clear text passwords

Mitigation Strategies

  • Upgrade the mariadb npm package to secure patched versions (3.2.4, 3.3.3, 3.4.6, or 3.5.3).
  • Enforce strict TLS configuration with rejectUnauthorized: true to block man-in-the-middle proxying.
  • Use local Unix domain sockets instead of unencrypted TCP loops for same-host database deployments.

Remediation Steps:

  1. Run 'npm install mariadb@3.5.3' or the corresponding patch level for your current major release branch.
  2. Audit existing connection configuration files to ensure ssl properties are explicitly defined and validate the CA chain.
  3. Implement static analysis (Semgrep) in application pipelines to identify connection objects that disable SSL or certificate authorization.

References

Read the full report for CVE-2026-55854 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)