{"id":"CVE-2026-55854","aliases":["BIT-mariadb-2026-55854","BIT-mariadb-min-2026-55854","BIT-mysql-client-2026-55854","EUVD-2026-68010","GHSA-42r5-vhpq-m858"],"status":"published","title":"MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00417,"percentile":0.36334,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-319","CWE-522"],"published":"2026-08-28T22:03:30Z","modified":"2026-11-11T02:49:03Z","fixes":[{"ecosystem":"npm","package":"mariadb","fixed_in":["3.2.4","3.3.3","3.4.6","3.5.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"mariadb","fixed_in":["3.2.4","3.3.3","3.4.6","3.5.3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mariadb-min","fixed_in":["3.2.4","3.3.3","3.4.6","3.5.3"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"mysql-client","fixed_in":["3.2.4","3.3.3","3.4.6","3.5.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"mariadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mariadb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.4"},{"introduced":"3.3.0"},{"fixed":"3.3.3"},{"introduced":"3.4.0"},{"fixed":"3.4.6"},{"introduced":"3.5.0"},{"fixed":"3.5.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mariadb-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.4"},{"introduced":"3.3.0"},{"fixed":"3.3.3"},{"introduced":"3.4.0"},{"fixed":"3.4.6"},{"introduced":"3.5.0"},{"fixed":"3.5.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mysql-client","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.4"},{"introduced":"3.3.0"},{"fixed":"3.3.3"},{"introduced":"3.4.0"},{"fixed":"3.4.6"},{"introduced":"3.5.0"},{"fixed":"3.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"mariadb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"mariadb","ranges":[{"type":"SEMVER","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"mariadb","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.6"}]}]},{"source":"osv","ecosystem":"npm","package":"mariadb","ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0"},{"fixed":"3.5.3"}]}]}],"products":[{"vendor":"mariadb-corporation","product":"mariadb-connector-nodejs"}],"references":[{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-42r5-vhpq-m858","tags":["x_refsource_CONFIRM","web","advisory"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/29733403cfe6519cdfe9c36c93765a468fbe285d","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/53b304264df84496d331dba2765c3634602f342e","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/9781de636841d34afdd08d81dd07d43edb82f85c","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/fbc159c2c8bd18c2db2d2e6587ab3020bbda64b6","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.6","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.3","tags":["x_refsource_MISC","web"]},{"url":"https://jira.mariadb.org/browse/CONJS-353","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-42r5-vhpq-m858"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55854","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55854.json","tags":["advisory"]},{"url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55854","title":"MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.","status":"published","published":"2026-08-28T22:03:30.2Z","modified":"2026-08-31T18:53:32.987Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-319","CWE-522"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-68010","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.","status":"published","published":"2026-08-28T22:03:30Z","modified":"2026-08-31T18:53:32Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:19.818565Z"}],"ghsa":[{"id":"GHSA-42r5-vhpq-m858","title":"MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials","description":"### Summary\n\nWhen PAM (dialog) authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password.\n\n### Details\n\nThe mysql_clear_password plugin is gated behind a secure connection: the driver refuses to transmit the password in cleartext over plain TCP. The sibling PAM plugin handler (SendPamAuthPacketFactory, server-side plugin name dialog) did not override that gate and inherited the default value false, so it was not subject to the same secure-transport requirement.\n\nAs a result, a hostile or man-in-the-middle server can issue an Authentication Switch Request for the dialog plugin over plain TCP, and the driver responds with the user's password in cleartext. With the default configuration (sslMode=DISABLE, restrictedAuth=null) this is reachable with no non-default options.\n\n### Am I affected?\n\nYou are affected if all of the following hold:\n\nYou use mariadb Connector/Node.js at a version below the patched release(s).\nConnections can occur over an insecure transport: plain TCP (sslMode=DISABLE), or a TLS mode that establishes server identity only via self-signed-certificate fingerprint validation.\nAn attacker can occupy an on-path (MITM) position, or otherwise cause the client to connect to a server they control, and present an Authentication Switch Request for the dialog plugin.\n\nConnections over properly verified TLS or a local Unix socket are not exposed to this vector.\n\n### Impact\n\nDisclosure of the authenticating account's password in cleartext to an on-path or hostile server. The captured credentials can then be reused to authenticate to the database (and, if reused elsewhere, beyond it).\n\n### Patches\n\nFixed in 3.2.4, 3.3.3, 3.4.6, and 3.5.3. Upgrade to the patched release on your branch (3.5.x → 3.5.3, 3.4.x → 3.4.6, 3.3.x → 3.3.3, 3.2.x and earlier → 3.2.4). PAM (dialog) is now treated exactly like mysql_clear_password: it may only run over a secure transport. SendPamAuthPacketFactory overrides the secure-required flag to true, and the authentication dispatcher permits a secure-required plugin only when the connection is TLS or a local Unix socket. The pre-existing check that blocks non-MITM-proof plugins when server identity relies solely on self-signed-certificate fingerprint validation continues to apply. Net effect: PAM is allowed over TLS or a Unix socket, and rejected over plain TCP or fingerprint-only connections.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n* Restrict the permitted authentication plugins via restrictedAuth so dialog cannot be negotiated over an insecure transport.\nAvoid PAM (dialog) authentication over plain TCP.\n\n###Credit\n\nReported by Yalguun Tumenkhuu ([@fg0x0](https://github.com/fg0x0/)).","status":"published","published":"2026-08-28T22:04:53Z","modified":"2026-08-28T22:04:54Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319","CWE-522"],"updated_at":"2026-11-02T14:41:08.084849Z"}],"nvd":[{"id":"CVE-2026-55854","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.","status":"published","published":"2026-08-28T23:17:08.203Z","modified":"2026-09-08T21:08:37.32Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-319","CWE-522"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-55854","title":"MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.","status":"published","published":"2026-08-28T22:03:30.2Z","modified":"2026-11-11T02:49:03.129426726Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319","CWE-522"],"updated_at":"2026-11-11T03:21:28.618498Z"},{"id":"GHSA-42r5-vhpq-m858","title":"MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials","description":"### Summary\n\nWhen PAM (dialog) authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password.\n\n### Details\n\nThe mysql_clear_password plugin is gated behind a secure connection: the driver refuses to transmit the password in cleartext over plain TCP. The sibling PAM plugin handler (SendPamAuthPacketFactory, server-side plugin name dialog) did not override that gate and inherited the default value false, so it was not subject to the same secure-transport requirement.\n\nAs a result, a hostile or man-in-the-middle server can issue an Authentication Switch Request for the dialog plugin over plain TCP, and the driver responds with the user's password in cleartext. With the default configuration (sslMode=DISABLE, restrictedAuth=null) this is reachable with no non-default options.\n\n### Am I affected?\n\nYou are affected if all of the following hold:\n\nYou use mariadb Connector/Node.js at a version below the patched release(s).\nConnections can occur over an insecure transport: plain TCP (sslMode=DISABLE), or a TLS mode that establishes server identity only via self-signed-certificate fingerprint validation.\nAn attacker can occupy an on-path (MITM) position, or otherwise cause the client to connect to a server they control, and present an Authentication Switch Request for the dialog plugin.\n\nConnections over properly verified TLS or a local Unix socket are not exposed to this vector.\n\n### Impact\n\nDisclosure of the authenticating account's password in cleartext to an on-path or hostile server. The captured credentials can then be reused to authenticate to the database (and, if reused elsewhere, beyond it).\n\n### Patches\n\nFixed in 3.2.4, 3.3.3, 3.4.6, and 3.5.3. Upgrade to the patched release on your branch (3.5.x → 3.5.3, 3.4.x → 3.4.6, 3.3.x → 3.3.3, 3.2.x and earlier → 3.2.4). PAM (dialog) is now treated exactly like mysql_clear_password: it may only run over a secure transport. SendPamAuthPacketFactory overrides the secure-required flag to true, and the authentication dispatcher permits a secure-required plugin only when the connection is TLS or a local Unix socket. The pre-existing check that blocks non-MITM-proof plugins when server identity relies solely on self-signed-certificate fingerprint validation continues to apply. Net effect: PAM is allowed over TLS or a Unix socket, and rejected over plain TCP or fingerprint-only connections.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n* Restrict the permitted authentication plugins via restrictedAuth so dialog cannot be negotiated over an insecure transport.\nAvoid PAM (dialog) authentication over plain TCP.\n\n###Credit\n\nReported by Yalguun Tumenkhuu ([@fg0x0](https://github.com/fg0x0/)).","status":"published","published":"2026-08-28T22:04:53Z","modified":"2026-09-02T16:25:25.069597389Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319","CWE-522"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"BIT-mariadb-2026-55854","title":"MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.","status":"published","published":"2026-09-02T14:46:36.329Z","modified":"2026-09-02T16:25:25.069597389Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mariadb-min-2026-55854","title":"MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.","status":"published","published":"2026-09-02T14:46:45.251Z","modified":"2026-09-02T16:25:25.069597389Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"BIT-mysql-client-2026-55854","title":"MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb","description":"MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.","status":"published","published":"2026-09-02T14:49:34.036Z","modified":"2026-09-02T16:25:25.069597389Z","updated_at":"2026-11-02T15:28:33.469426Z"}]}}