CVE-2026-55215

MariaDB Connector/Node.js, the official Node.js client for connecting applications to MariaDB and MySQL databases, sends the database password before it has finished validating the server's TLS certificate when ssl is enabled without a pinned CA or server certificate. A bug in the handshake authentication-switch logic can cause the mysql_clear_password plugin to be used for the initial exchange, transmitting the password before the post-TLS identity check. An active man-in-the-middle can present a self-signed certificate, capture the password, and then authenticate to the database directly with it, even though the connector subsequently rejects the server and closes the connection. Only applications running affected connector versions (prior to 3.3.3, 3.4.6, or 3.5.3) that enable ssl without pinning a CA or server certificate are exposed. No public exploit, KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.4% probability of exploitation within 30 days.

What to do: Upgrade MariaDB Connector/Node.js to 3.3.3, 3.4.6, or 3.5.3, matching your current 3.x maintenance branch. As an interim mitigation, pin the CA or server certificate in the connector's ssl options instead of enabling ssl without a pinned certificate, which prevents credentials from being sent before the server is validated. Review database authentication logs for unexpected successful logins, since any prior on-path attacker could have captured and reused database credentials.