DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55857: CVE-2026-55857: Insecure Credential Transmission via PAM Dialog Plugin in MariaDB Connector/J

#security #cve #cybersecurity

CVE-2026-55857: Insecure Credential Transmission via PAM Dialog Plugin in MariaDB Connector/J

Vulnerability ID: CVE-2026-55857
CVSS Score: 5.9
Published: 2026-08-28

A transport-security omission in the MariaDB Connector/J driver allows remote on-path adversaries or rogue database servers to capture database credentials in cleartext. Under default configurations (sslMode=DISABLE), the driver fails to enforce encrypted channels when negotiating the Pluggable Authentication Module (PAM) 'dialog' plugin, resulting in cleartext transmission of sensitive passwords.

TL;DR

MariaDB Connector/J fails to enforce TLS/SSL when negotiating the PAM 'dialog' authentication plugin. An attacker with on-path network access or running a rogue database server can trigger an authentication switch to 'dialog' and harvest the database password in plaintext.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-319: Cleartext Transmission of Sensitive Information
  • Attack Vector: Network (AV:N)
  • Attack Complexity: High (AC:H)
  • CVSS Base Score: 5.9 (Medium)
  • Impact: High Confidentiality Loss (C:H)
  • Exploit Status: poc
  • CISA KEV Status: Not Listed

Affected Systems

  • Applications utilizing MariaDB Connector/J (mariadb-java-client) to connect to MariaDB or MySQL servers.
  • mariadb-connector-j: < 2.7.14 (Fixed in: 2.7.14)
  • mariadb-connector-j: >= 3.0.0, < 3.3.5 (Fixed in: 3.3.5)
  • mariadb-connector-j: >= 3.4.0, < 3.4.3 (Fixed in: 3.4.3)
  • mariadb-connector-j: >= 3.5.0, < 3.5.9 (Fixed in: 3.5.9)

Code Analysis

Commit: f4a727c

Overriding PAM dialog secure transport requirement in modern development branch (SendPamAuthPacketFactory.java)

Commit: a8599ab

Backport fix for PAM dialogue secure transport requirement in older legacy branches (SendPamAuthPacket.java)

Exploit Details

  • MariaDB JIRA (CONJ-1320): The technical discussion identifies that establishing connection testing over unsecure channels allows reproduction using mock PAM server-side switches.

Mitigation Strategies

  • Upgrade the MariaDB Connector/J dependency to a patched version (2.7.14, 3.3.5, 3.4.3, or 3.5.9).
  • Configure the JDBC connection string with sslMode=verify-full or sslMode=verify-ca to prevent on-path connection tampering.
  • Restrict allowed client-side authentication mechanisms via the restrictedAuth parameter to exclude 'dialog'.

Remediation Steps:

  1. Identify all internal applications importing org.mariadb.jdbc:mariadb-java-client.
  2. Update the project build files (pom.xml, build.gradle) to reference the corresponding secure release (e.g., 3.5.9).
  3. For applications that cannot be immediately updated, append restrictedAuth=mysql_native_password to the JDBC connection string.
  4. Ensure production environment database connection strings do not use sslMode=DISABLE or sslMode=trust over public or untrusted networks.

References

Read the full report for CVE-2026-55857 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)