CVE-2026-55215

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions 3.3.0 through 3.3.2 MariaDB Connector/Node.js versions 3.4.0 through 3.4.5 MariaDB Connector/Node.js versions 3.5.0 through 3.5.2

Description When SSL is enabled without a pinned CA or server certificate, the connector sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server selecting mysql clear password as the initial authentication plugin can receive the password before the post-TLS identity check. Additionally, in lib/cmd/handshake/authentication.js, an authentication switch may evaluate the previous plugin instead of the requested target plugin, allowing mysql clear password to send credentials first. An active man-in-the-middle attacker can present a self-signed certificate to capture the database password and use it for direct authentication, even though the connector eventually rejects the server and closes the connection.

Recommendations Update MariaDB Connector/Node.js to version 3.2.4 or later. Update MariaDB Connector/Node.js to version 3.3.3 or later. Update MariaDB Connector/Node.js to version 3.4.6 or later. Update MariaDB Connector/Node.js to version 3.5.3 or later. Configure certificate verification explicitly by providing the server/CA certificate and using a verifying SSL mode such as VERIFY CA or VERIFY FULL.