CVE-2026-55854: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-55854 is a cleartext credential disclosure vulnerability in MariaDB Connector/Node.js affecting its PAM (dialog) authentication handling. When PAM authentication is negotiated over an insecure transport, the connector can be coerced by a hostile or on-path server into transmitting the account password in cleartext over plain TCP. Affected versions include all releases before 3.2.4, 3.3.0–3.3.2, 3.4.0–3.4.5, and 3.5.0–3.5.2 of the mariadb npm package. The vulnerability was reported by Yalguun Tumenkhuu (@fg0x0) and disclosed on August 28, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-522 (Insufficiently Protected Credentials). The mysql_clear_password plugin was correctly gated behind a secure-transport check, but the sibling PAM plugin handler (SendPamAuthPacketFactory / PamPasswordAuth class in lib/cmd/handshake/auth/pam-password-auth.js) did not override the requireSecure() method and inherited the default value of false, bypassing the same protection. With the default configuration (sslMode=DISABLE, restrictedAuth=null), a hostile or man-in-the-middle server can issue an Authentication Switch Request for the dialog plugin over plain TCP, and the connector responds with the user's password in cleartext. The fix adds a requireSecure() override returning true to PamPasswordAuth, and the authentication dispatcher in lib/cmd/handshake/authentication.js now enforces that secure-required plugins only operate over TLS or a local Unix socket (GitHub Advisory, Patch Commit).

Successful exploitation results in full disclosure of the authenticating database account's password in cleartext to an on-path or hostile server. The captured credentials can be immediately reused to authenticate directly to the database, and if the credentials are shared across systems, they may enable lateral movement beyond the database tier. There is no integrity or availability impact — the vulnerability is purely a confidentiality breach — but the credential exposure can serve as a foothold for broader compromise (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires the attacker to occupy a man-in-the-middle (on-path) network position or control a rogue server that the client connects to, making exploitation moderately complex (CVSS Attack Complexity: High). The EPSS score is approximately 0.0028 (0.28%), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Position for interception: Gain a man-in-the-middle network position between the Node.js application and the MariaDB/MySQL server (e.g., via ARP spoofing, DNS poisoning, or BGP hijacking), or operate a rogue MariaDB-compatible server that the client can be directed to connect to.
2. Confirm vulnerable configuration: Verify the target application uses the mariadb npm connector at a vulnerable version (< 3.2.4, 3.3.0–3.3.2, 3.4.0–3.4.5, or 3.5.0–3.5.2) with default settings (sslMode=DISABLE, restrictedAuth=null) and PAM (dialog) authentication enabled on the server.
3. Intercept the connection handshake: When the client initiates a TCP connection to the database server on port 3306 (or configured port), intercept or respond to the initial handshake.
4. Send Authentication Switch Request: During the handshake, send an Authentication Switch Request packet specifying the dialog plugin name. Because the vulnerable connector does not enforce a secure-transport gate for the dialog plugin, it will proceed without rejecting the request.
5. Receive cleartext password: The connector responds to the dialog plugin challenge by transmitting the account password in cleartext over the plain TCP connection, which the attacker captures.
6. Reuse credentials: Use the captured plaintext password to authenticate directly to the real MariaDB/MySQL database or any other service where the credentials are reused (GitHub Advisory).

• Network: Unexpected TCP connections to port 3306 (or the configured database port) from hosts not matching the legitimate database server IP; network captures showing MariaDB protocol Authentication Switch Request packets specifying the dialog plugin followed by a cleartext password response on unencrypted TCP sessions.
• Logs: Application-level errors or unexpected authentication failures if the attacker's rogue server rejects the connection after capturing credentials; database server logs showing authentication attempts from unexpected source IPs using PAM/dialog authentication.
• Process/Application: Node.js application logs showing connection errors with messages such as dialog authentication requires TLS or a local socket after upgrading to a patched version (indicating prior unpatched exposure); unexpected database login events from IP addresses not associated with the application server.

Upgrade the mariadb npm package to a patched version: 3.2.4, 3.3.3, 3.4.6, or 3.5.3 (select the release matching your current branch). The fix enforces that PAM (dialog) authentication — like mysql_clear_password — is only permitted over TLS or a local Unix socket, and will throw an error (ER_CLEAR_PASSWORD_WITHOUT_SSL) if attempted over plain TCP. If an immediate upgrade is not possible, apply the following workarounds: (1) set restrictedAuth in the connector options to exclude the dialog plugin, preventing it from being negotiated over insecure transports; (2) configure all database connections to use properly verified TLS (sslMode set to a verified TLS mode) or connect via a local Unix socket. Note that fingerprint-only server identity validation (self-signed certificate trust mode) is not sufficient to prevent this attack (GitHub Advisory).