CVE-2026-55857

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9

Description When using PAM (dialog) authentication, the connector can be coerced into transmitting the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this by sending an Authentication Switch Request for the dialog plugin over plain TCP. This occurs because the SendPamAuthPacketFactory (and SendPamAuthPacket in older branches) does not require a secure transport, unlike the mysql clear password plugin. Under default configurations where sslMode is set to DISABLE and restrictedAuth is null, the driver may disclose the user's password to an on-path attacker. This issue does not affect connections using properly verified TLS or local Unix sockets.

Recommendations Update to version 2.7.14. Update to version 3.3.5. Update to version 3.4.3. Update to version 3.5.9. Connect over verified TLS by setting sslMode to verify-full to prevent server impersonation. Use a local Unix socket for connections. Restrict permitted authentication plugins via restrictedAuth to prevent the dialog plugin from being negotiated over insecure transports.