CVE-2026-55856: CVE-2026-55856: Credential Disclosure via Out-of-Order Handshake in MariaDB Connector/J

CVE-2026-55856: Credential Disclosure via Out-of-Order Handshake in MariaDB Connector/J

Vulnerability ID: CVE-2026-55856
CVSS Score: 5.9
Published: 2026-08-28

A critical credential disclosure vulnerability in MariaDB Connector/J allows remote attackers to capture raw database passwords. The driver transmits plaintext passwords prior to verifying TLS certificate fingerprints when configured in ephemeral trust fallback states.

TL;DR

MariaDB Connector/J allows a Man-in-the-Middle attacker to intercept and steal plaintext database passwords because the driver transmits authentication responses during initial handshakes before enforcing certificate fingerprint verification checks.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-522
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• CVSS v3.1 Score: 5.9 (Medium)
• Exploit Status: Proof of Concept
• CISA KEV Status: Not Listed

Affected Systems

• MariaDB Connector/J Java driver
• MariaDB Connector/J: < 2.7.14 (Fixed in: 2.7.14)
• MariaDB Connector/J: >= 3.3.0, < 3.3.5 (Fixed in: 3.3.5)
• MariaDB Connector/J: >= 3.4.0, < 3.4.3 (Fixed in: 3.4.3)
• MariaDB Connector/J: >= 3.5.0, < 3.5.9 (Fixed in: 3.5.9)

Code Analysis

Commit: 149ec6a

Backport fix for credential leak over self-signed certificates in stable branch

Commit: d90b987

Core branch fix using AuthenticationPluginFactory initialization checks

Exploit Details

• MariaDB GitHub Security Advisory: Contains regression test code to reproduce client credential leakage using a mock rogue server

Mitigation Strategies

• Upgrade MariaDB Connector/J dependencies to fixed versions.
• Explicitly configure trusted certificates on client connections using the serverSslCert parameter.
• Supply custom JVM trust stores to connections to disable ephemeral fallback trust managers.

Remediation Steps:

1. Locate Maven, Gradle, or manual jar configurations referencing vulnerable MariaDB Connector/J packages.
2. Replace vulnerable versions with patched releases: 2.7.14, 3.3.5, 3.4.3, or 3.5.9.
3. Update database connection strings to supply valid server certificates if using verify-ca or verify-full sslModes.

References

• NVD CVE-2026-55856
• GitHub Advisory GHSA-g9jj-cgmh-9f38
• MariaDB Jira Tracking Ticket CONJ-1325

---

Read the full report for CVE-2026-55856 on our website for more details including interactive diagrams and full exploit analysis.