CVE-2026-55215 in MariaDB Connector Node.js
Summary
by MITRE • 08/28/2026
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing mysql_clear_password to send the credential first. An active man-in-the-middle can present a self-signed certificate, capture the database password, and use it to authenticate directly even though the connector later rejects the server and closes the connection. This issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The MariaDB Connector for Node.js serves as a critical bridge between applications built on the JavaScript runtime environment and MariaDB or MySQL database servers. This connector facilitates secure communication by supporting Transport Layer Security (TLS) encryption to protect data in transit. However, prior to versions 3.3.3, 3.4.6, and 3.5.3, a significant security flaw existed within the authentication handshake process when TLS was enabled without strict certificate pinning or server certificate validation configured by the application developer. This vulnerability stems from an incorrect ordering of operations during the initial connection establishment phase, specifically involving how credentials are transmitted relative to identity verification procedures.
The technical root cause lies in two specific files within the connector's source code: lib/cmd/handshake/auth/handshake.js and lib/cmd/handshake/authentication.js. In the handshake logic, if a server selects mysql_clear_password as the initial authentication plugin, the connector is programmed to send the user credentials before completing the post-TLS identity check. This sequence error means that the password is transmitted over the network while the TLS session is still being established and validated. Furthermore, in the authentication switch mechanism, there was a logic flaw where the system could evaluate the previous authentication plugin instead of the requested target plugin. This inconsistency allowed the mysql_clear_password method to trigger credential transmission prematurely, bypassing the intended security controls that should verify server identity before exposing sensitive data.
The operational impact of this vulnerability is severe for any application relying on MariaDB Connector/Node.js with TLS enabled but without pinned certificates or explicit server certificate verification. An active man-in-the-middle attacker positioned between the client and the database server can intercept the connection attempt. By presenting a self-signed certificate that does not match the expected identity, the attacker exploits this timing flaw to capture the plaintext password before the connector performs its final validation checks. Although the connector eventually detects the invalid certificate and closes the connection after sending the credentials, the damage is already done as the sensitive authentication material has been exposed. This allows an adversary to potentially use the captured password to authenticate directly against the database server from a different location or at a later time, leading to unauthorized access, data exfiltration, or further compromise of the underlying systems.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-319: Cleartext Transmission of Credentials and CWE-295: Improper Certificate Validation. It also maps to MITRE ATT&CK techniques related to Credential Access via Network Sniffing, specifically T1040, where attackers intercept network traffic to steal authentication secrets. The failure to enforce certificate pinning or strict server identity verification prior to credential transmission represents a critical deviation from secure coding practices recommended by industry standards for database connectivity libraries.
To mitigate this risk, organizations must upgrade the MariaDB Connector/Node.js package to version 3.3.3, 3.4.6, or 3.5.3 and later releases where these timing issues have been resolved. In addition to updating the library, developers should implement certificate pinning by configuring the connector to validate server certificates against a known set of trusted Certificate Authorities (CAs) or specific public keys. This ensures that even if an attacker attempts a man-in-the-middle attack with a self-signed certificate, the connection will be terminated before any credentials are transmitted. Regularly auditing dependency versions and enforcing strict TLS configurations in production environments are essential steps to maintain the integrity and confidentiality of database communications.