CVE-2026-55854 in Connector
Summary
by MITRE • 08/29/2026
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/29/2026
MariaDB Connector/Node.js serves as a critical bridge for Node.js applications seeking to interact with MariaDB or MySQL database systems. A significant security vulnerability was identified in versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 regarding the handling of authentication protocols over unencrypted connections. Specifically, when using PAM dialog authentication, the connector failed to enforce secure transport requirements that were otherwise applied to other authentication methods like mysql_clear_password. This inconsistency created a pathway for sensitive credential disclosure under specific configuration conditions where SSL mode was disabled and restricted authentication settings allowed broader plugin negotiation.
The technical root cause lies within the implementation of the SendPamAuthPacketFactory behavior found in lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js. In these modules, the logic governing server-side plugin dialog negotiations lacked a necessary secure-transport gate. Consequently, when an application connects with default settings such as sslMode set to DISABLE and restrictedAuth left at null, the connector does not verify that the communication channel is encrypted before proceeding with authentication handshakes. This allows a malicious or on-path server to issue an Authentication Switch Request for dialog over plain TCP without triggering any security warnings or connection failures regarding transport insecurity.
The operational impact of this flaw is severe, as it enables the disclosure of account passwords in cleartext. An attacker positioned between the client and the database server can intercept these unencrypted authentication packets during the handshake process. Because the password is transmitted plainly over the network without encryption, any entity capable of monitoring traffic on that segment gains immediate access to valid credentials. This compromises not only the specific user account but potentially other systems if credential reuse practices are employed by the application or its users. The vulnerability effectively negates the confidentiality guarantees expected from secure database connections when TLS is disabled.
Mitigation strategies must prioritize ensuring that authentication data is never transmitted over unencrypted channels. Upgrading to MariaDB Connector/Node.js versions 3.2.4, 3.3.3, 3.4.6, or 3.5.3 resolves the issue by implementing proper secure-transport checks for PAM dialog authentication similar to those already present in other authentication plugins. For environments where upgrading is not immediately feasible, administrators should enforce strict TLS configurations with sslMode set to REQUIRED or VERIFY_CA rather than DISABLED. It is crucial to note that merely validating server fingerprints without enforcing full certificate chain verification and encrypted transport does not prevent this specific attack vector. Additionally, using local Unix sockets for database connections inherently prevents network-based interception attacks but may not be feasible for all distributed application architectures.
This vulnerability aligns with CWE-319, which classifies the use of cleartext transmission of sensitive information as a critical weakness in software design and implementation. From an offensive security perspective, this flaw facilitates credential harvesting during active sessions, corresponding to ATT&CK technique T1040 Network Sniffing where attackers capture network traffic to extract login credentials. The failure to enforce encryption for authentication data represents a fundamental breach of the principle of least privilege regarding information exposure, allowing unauthorized parties to gain access privileges they do not possess by simply observing network packets. Organizations must treat this as a high-priority remediation item due to the direct impact on identity and access management security posture.