CVE-2026-55854

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3

Description MariaDB Connector/Node.js can disclose an account password in cleartext when PAM dialog authentication is negotiated over an insecure transport. This occurs because the SendPamAuthPacketFactory behavior for the server-side plugin dialog in lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js lacked the secure-transport gate applied to mysql clear password. Consequently, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the password. This is particularly reachable with default settings where sslMode is set to DISABLE and restrictedAuth is null. Properly verified TLS and local Unix sockets prevent this issue, but fingerprint-only server identity validation is insufficient to mitigate the risk.

Recommendations Update MariaDB Connector/Node.js to version 3.2.4 or later. Update MariaDB Connector/Node.js to version 3.3.3 or later. Update MariaDB Connector/Node.js to version 3.4.6 or later. Update MariaDB Connector/Node.js to version 3.5.3 or later. Restrict the permitted authentication plugins via restrictedAuth to prevent dialog negotiation over insecure transports. Avoid using PAM (dialog) authentication over plain TCP.