CVE-2026-55856

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9

Description When a Java application connects using sslMode=verify-full or sslMode=verify-ca with a password but without configuring serverSslCert or trustStore, the connector may accept an untrusted self-signed certificate via the fallbackToSystemTrustStore=true ephemeral trust manager. While identity binding is enforced during the OK-packet and authentication-switch paths, it is bypassed during the initial-handshake path. Specifically, the HandshakeResponse.encode() function can send a mysql clear password response before verifying the certificate fingerprint, the sslMode, or whether the authentication plugin is resistant to man-in-the-middle attacks. This allows an active man-in-the-middle or hostile server to present a self-signed certificate, claim to be MariaDB, and capture the database password in cleartext before the connection is rejected.

Recommendations Update MariaDB Connector/J to version 2.7.14 or later. Update MariaDB Connector/J to version 3.3.5 or later. Update MariaDB Connector/J to version 3.4.3 or later. Update MariaDB Connector/J to version 3.5.9 or later. As a temporary workaround, pin the server certificate by configuring serverSslCert with the real CA or server certificate to ensure self-signed certificates are rejected at the TLS layer.