CVE-2026-55857: 
Java vulnerability analysis and mitigation

CVE-2026-55857 is a cleartext credential disclosure vulnerability in MariaDB Connector/J (the Java JDBC driver for MariaDB and MySQL databases). When PAM (dialog) authentication is used, the connector can be coerced by a hostile or man-in-the-middle server into transmitting the user's account password in cleartext over an unencrypted TCP connection. Affected versions include all releases prior to 2.7.14, 3.0.0–3.3.4, 3.4.0–3.4.2, and 3.5.0–3.5.8. The vulnerability was reported by Yalguun Tumenkhuu (@fg0x0), published via GitHub Advisory on July 9, 2026, and assigned a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory).

The root cause is a missing secure-transport enforcement gate on the PAM authentication plugin handler (CWE-319: Cleartext Transmission of Sensitive Information; CWE-522: Insufficiently Protected Credentials). The mysql_clear_password plugin correctly requires a secure connection before transmitting credentials, but the sibling PAM handler (SendPamAuthPacketFactory, server-side plugin name dialog) did not override the requireSsl()/requireSecure() flag and inherited the default value of false. As a result, a hostile or on-path server can issue an Authentication Switch Request for the dialog plugin over plain TCP, and the driver responds with the user's password in cleartext. This is exploitable with the default connector configuration (sslMode=DISABLE, restrictedAuth=null) — no non-default options are required. The fix adds a requireSecure() override returning true to SendPamAuthPacketFactory, and the authentication dispatcher now blocks clear-text plugins unless the connection is TLS or a local Unix socket (GitHub Advisory, Patch Commit).

Successful exploitation results in full disclosure of the authenticating database account's password in cleartext to an on-path attacker or hostile server. The captured credentials can be directly reused to authenticate to the database, enabling unauthorized data access, data exfiltration, or further lateral movement within the database environment. There is no integrity or availability impact — the vulnerability is purely a confidentiality issue, but the credential theft can serve as a stepping stone to broader compromise (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.197%, reflecting low near-term exploitation probability. Exploitation requires an attacker to occupy a man-in-the-middle network position or control a server the client connects to, raising the attack complexity (CVSS AC:High). However, the default connector configuration (sslMode=DISABLE, restrictedAuth=null) makes affected deployments reachable without any non-default settings.

1. Reconnaissance: Identify Java applications using MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, or 3.5.9 that connect to a MariaDB/MySQL database over plain TCP (no TLS) using PAM/dialog authentication.
2. Establish MITM or hostile server position: Position the attacker between the Java client and the database server (e.g., via ARP spoofing, DNS poisoning, or BGP hijacking on the network path), or set up a server that the client can be directed to connect to.
3. Intercept the connection handshake: Allow the initial TCP connection to proceed. When the client initiates the MariaDB protocol handshake, intercept or respond to it.
4. Send Authentication Switch Request: Issue a forged Authentication Switch Request packet specifying the dialog plugin name. Because the vulnerable connector does not enforce a secure-transport requirement for this plugin, it will proceed without rejecting the request.
5. Capture cleartext password: The connector responds to the dialog challenge by transmitting the user's password in cleartext over the plain TCP connection. Capture this packet using a network sniffer (e.g., Wireshark, tcpdump).
6. Reuse credentials: Use the captured plaintext password to authenticate directly to the real database server as the victim account (GitHub Advisory, Patch Commit).

• Network: Unencrypted TCP traffic on the MariaDB port (default 3306) containing an Authentication Switch Request packet specifying the dialog plugin, followed by a cleartext password response from the client; unexpected ARP or DNS anomalies on the network path between the Java application and the database server.
• Logs: Database server authentication logs showing login attempts from unexpected IP addresses using the same account credentials shortly after a legitimate connection attempt; MariaDB error logs showing SQLException with message containing if SSL is not enabled (indicating a patched client correctly rejecting the attack).
• Process/Application: Java application logs showing unexpected authentication failures or connection errors to the database, which may indicate an active MITM interception attempt disrupting the connection flow.

Upgrade MariaDB Connector/J to a patched version: 2.7.14 (for 2.x branch), 3.3.5 (for 3.0/3.1/3.2/3.3.x), 3.4.3 (for 3.4.x), or 3.5.9 (for 3.5.x) (GitHub Advisory, Release 3.4.3, Release 3.5.9). If an immediate upgrade is not possible, apply one of the following workarounds: (1) configure sslMode=verify-full to enforce verified TLS, preventing a MITM from impersonating the server; (2) use a local Unix socket connection, which is not exposed to this network-based attack vector; or (3) set restrictedAuth to exclude the dialog plugin, preventing PAM authentication from being negotiated over insecure transports.

The vulnerability was reported by security researcher Yalguun Tumenkhuu (@fg0x0), who also reported several other security issues in MariaDB Connector/J around the same time (CONJ-1317, CONJ-1315). HeroDevs published a blog post covering this CVE alongside related MariaDB Connector/J vulnerabilities in the context of Spring Boot applications (HeroDevs Blog). No significant broader community controversy or vendor dispute has been observed.