CVE-2026-55854

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55854
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55854.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55854
Aliases
Published
2026-08-28T22:03:30.200Z
Modified
2026-08-30T03:47:24.078573880Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb
Details

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysqlclearpassword. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

Database specific 
{
    "cwe_ids": [
        "CWE-319",
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55854.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-nodejs

Affected ranges

Type
GIT
Repo
https://github.com/mariadb-corporation/mariadb-connector-nodejs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
b65aca10b77f5ede83f16a8edd0537b2ef12a16f
Introduced
24a58245cba201da91f41f7f96f8dd165d31c6c7
Fixed
e0064ca9171b0046ad4be1a1dc1771e7dd0bcd96
Fixed
14e0f16bd78584b3b24db33c1c6e62e3a3d241a2
Fixed
07e6f631a6052649b72e9aa024583d305ac7611d
Fixed
1d50f7210af2e01bf90b155e073f041952901839
Fixed
29733403cfe6519cdfe9c36c93765a468fbe285d
Fixed
53b304264df84496d331dba2765c3634602f342e
Fixed
9781de636841d34afdd08d81dd07d43edb82f85c
Fixed
fbc159c2c8bd18c2db2d2e6587ab3020bbda64b6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.2.4"
        },
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.3"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.3"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.7.0
2.*
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
2.3.0
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.6
3.*
3.0.0-ga
3.2.0
3.2.1
3.2.2
3.2.3
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.5.0-rc.0
3.5.1
3.5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55854.json"