CVE-2026-55860: Cleartext Password Disclosure in MariaDB Connector/R2DBC
Vulnerability ID: CVE-2026-55860
CVSS Score: 5.9
Published: 2026-08-28
A security vulnerability in the MariaDB Connector/R2DBC client driver allows credential theft during the database authentication phase. The client driver does not gate clear-text password authentication plugins on transport encryption, making it possible for on-path attackers or hostile database servers to intercept passwords.
TL;DR
MariaDB Connector/R2DBC before 1.4.1 fails to verify if TLS or Unix socket encryption is active before using clear-text password authentication plugins, allowing network attackers to intercept plaintext credentials.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-319 / CWE-522
- Attack Vector: Network (AV:N)
- Attack Complexity: High (AC:H)
- CVSS Score: 5.9 (Medium)
- Exploit Status: poc
- KEV Status: Not Listed
Affected Systems
- Applications utilizing MariaDB Connector/R2DBC (Java driver) on plain TCP connections.
-
MariaDB Connector/R2DBC: < 1.4.1 (Fixed in:
1.4.1)
Code Analysis
Commit: be78660
Introduce requireSecure capability to AuthenticationPlugin and enforce in AuthenticationFlow
Mitigation Strategies
- Upgrade the MariaDB Connector/R2DBC client library to version 1.4.1 or above.
- Enforce strict TLS verification modes in the driver configuration.
- Isolate database traffic to secure, private subnets.
Remediation Steps:
- Identify all JVM applications utilizing the 'org.mariadb:r2dbc-mariadb' dependency.
- Update the project build files (pom.xml or build.gradle) to reference version 1.4.1.
- Verify connection configurations and ensure 'sslMode' is set to 'VERIFY_FULL' or 'VERIFY_CA' rather than 'DISABLE' or 'TRUST'.
- Deploy the updated application and monitor connection logs for any authentication refusals.
References
Read the full report for CVE-2026-55860 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)