CVE-2026-55215highCWE-295CWE-522

CVE-2026-55215: high-severity vulnerability in mariadb-corporation mariadb-connector-nodejs

MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

Published · Updated

Follow this CVE+ Monitor mariadb-connector-nodejs+ Monitor mariadb

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing mysql_clear_password to send the credential first. An active man-in-the-middle can present a self-signed certificate, capture the database password, and use it to authenticate directly even though the connector later rejects the server and closes the connection. This issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
mariadb-corporation · mariadb-connector-nodejs
Related CVEs — mariadb-corporation mariadb-connector-nodejs

In the same product, most dangerous first.

CVE-2026-55855MEDIUMMariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsetsEPSS 0.7%CVE-2026-107384HIGHMariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)EPSS 0.4%CVE-2026-107385HIGHMariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPESEPSS 0.4%CVE-2026-55854MEDIUMMariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadbEPSS 0.4%CVE-2026-107383HIGHMariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersEPSS 0.4%CVE-2026-107382MEDIUMMariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSEPSS 0.2%