BIT-mysql-client-2026-55854

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/mysql-client/BIT-mysql-client-2026-55854.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-mysql-client-2026-55854
Aliases
Published
2026-09-02T14:49:34Z
Modified
2026-09-02T16:25:25Z
Summary
MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb
Details

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:node.js:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / mysql-client

Package

Name
mysql-client
Purl
pkg:bitnami/mysql-client

Severity

  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.4
Introduced
3.3.0
Fixed
3.3.3
Introduced
3.4.0
Fixed
3.4.6
Introduced
3.5.0
Fixed
3.5.3

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/mysql-client/BIT-mysql-client-2026-55854.json"