CVE-2026-107819

Name of the Vulnerable Software and Affected Versions MariaDB Connector/C versions 3.4.1 through 3.4.9

Description The libmariadb Zero-Configuration SSL authentication-switch logic fails to reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. This allows a man-in-the-middle attacker possessing a valid certificate for a different hostname to request mysql clear password() and capture the database password within a TLS connection controlled by the attacker.

Recommendations Update to version 3.4.10.