CVE-2026-55215: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-55215 is a credential disclosure vulnerability in MariaDB Connector/Node.js where the connector leaks cleartext database passwords to an active man-in-the-middle (MitM) attacker despite SSL/TLS being enabled. When SSL is configured without a pinned CA or server certificate, the connector transmits credentials before completing certificate fingerprint validation, allowing an attacker presenting a self-signed certificate to capture the password during the handshake. Affected versions include all releases before 3.2.4, 3.3.0–3.3.2, 3.4.0–3.4.5, and 3.5.0–3.5.2. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory). The vulnerability was published on August 28, 2026, and patches were released the same day (GitHub Advisory).

The vulnerability stems from two distinct flaws classified as CWE-295 (Improper Certificate Validation) and CWE-522 (Insufficiently Protected Credentials). In lib/cmd/handshake/auth/handshake.js, when a server selects mysql_clear_password as the initial authentication plugin, the connector sends the password in cleartext before the post-TLS fingerprint validation check executes. In lib/cmd/handshake/authentication.js, during an authentication plugin switch, the guard logic evaluated the previous plugin's permitHash() result rather than the newly requested plugin's, allowing a server to advertise a benign initial plugin and then switch to mysql_clear_password to bypass the check entirely. Additionally, the base PluginAuth class defaulted permitHash() to true, meaning all plugins were treated as hashable unless they explicitly opted out — the fix reverses this to default false (GitHub Commit, GitHub Advisory).

A successful exploit results in full disclosure of the database account password (high confidentiality impact) to any attacker with an active MitM position on the network path between the Node.js application and the MariaDB/MySQL server. Although the connector ultimately rejects the rogue server and closes the connection, the captured plaintext credential can be used immediately to authenticate directly against the real database server, potentially granting the attacker full access to all data the compromised account can reach. There is no integrity or availability impact from the vulnerability itself, but secondary exploitation using the stolen credential could lead to data exfiltration, modification, or lateral movement within the database environment (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly). Exploitation requires an active MitM network position — a non-trivial precondition — but no authentication or user interaction is needed once that position is established, and attack complexity is rated Low. The vulnerability was originally reported via HackerOne (report #3777370) by researcher haaahaaahiihiiii (GitHub Advisory).

1. Gain MitM position: Position yourself on the network path between the Node.js application and the MariaDB/MySQL server using ARP spoofing, DNS poisoning, rogue Wi-Fi, or a compromised network device.
2. Intercept TLS connection: When the application initiates a connection with ssl: true but no pinned CA or server certificate, intercept the TCP stream and present a self-signed TLS certificate to the client.
3. Advertise vulnerable auth plugin: During the MySQL handshake, respond with mysql_clear_password as the initial authentication plugin (or advertise a benign plugin and then issue an auth-switch request to mysql_clear_password).
4. Capture cleartext password: Because the connector sends credentials before completing fingerprint validation, the plaintext database password is transmitted to the attacker's rogue server and can be captured from the handshake traffic.
5. Authenticate to real server: Use the captured plaintext credential to connect directly to the legitimate MariaDB/MySQL server, gaining full database access under the compromised account (GitHub Advisory, GitHub Commit).

• Network: Unexpected TLS handshakes to the database port (default 3306) from an IP address that is not the legitimate database server; self-signed certificates presented on the database port from unknown hosts.
• Network: MySQL authentication packets containing mysql_clear_password plugin negotiation observed in network captures on segments where this plugin is not expected.
• Logs: Application-side connection errors referencing ER_SELF_SIGNED_BAD_PLUGIN or messages such as "Unsupported authentication plugin with Self signed certificates" in Node.js application logs (patched versions only).
• Database Logs: Successful logins to the MariaDB/MySQL server from unexpected source IP addresses using valid credentials, particularly shortly after a failed/aborted connection attempt from the application server's IP.
• Network: ARP table anomalies or duplicate MAC addresses on the local network segment hosting the application or database servers, indicating potential ARP spoofing.

Upgrade MariaDB Connector/Node.js to one of the patched versions: 3.2.4, 3.3.3, 3.4.6, or 3.5.3 (GitHub Advisory, Release 3.3.3). As an immediate workaround prior to upgrading, explicitly provide the server or CA certificate in the SSL configuration and use a verifying SSL mode such as VERIFY_CA or VERIFY_FULL; this ensures the connector can perform proper certificate chain validation rather than relying on post-handshake fingerprint checking. Alternatively, setting ssl: { rejectUnauthorized: false } (trust mode) prevents the vulnerable fingerprint-validation code path from being triggered, though this removes server identity verification entirely and should only be used in isolated, trusted network environments.