CVE-2026-55860

Name of the Vulnerable Software and Affected Versions MariaDB Connector/R2DBC versions prior to 1.4.1

Description The driver does not require a secure transport before using clear-text password authentication plugins. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql clear password or dialog (PAM) over a plain-TCP unencrypted connection. Because the AuthenticationPlugin interface lacks the capability to require a secure connection, the AuthenticationFlow allows ClearPasswordPluginFlow or PamPluginFlow to transmit the user's password as cleartext bytes over the network. An on-path attacker can capture these credentials to authenticate directly to the database server.

Recommendations Update to version 1.4.1 or later. As a temporary workaround, configure explicit certificate verification by providing the server/CA certificate and using a verifying SSL mode, such as VERIFY CA or VERIFY FULL, to ensure the connection is encrypted and the server identity is verified before credentials are sent.