CVE-2026-55857

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55857
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55857.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55857
Aliases
Downstream
Related
Published
2026-08-28T22:44:24.351Z
Modified
2026-08-30T08:17:25.153713Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
Details

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behind a secure transport, but the sibling PAM handler SendPamAuthPacketFactory, named dialog by the server, does not declare that requirement and inherits the default secure-required value false; older branches implement the same affected behavior in SendPamAuthPacket. A hostile or man-in-the-middle server can send an Authentication Switch Request for dialog over plain TCP, causing the driver to return the user's password in cleartext when sslMode=DISABLE and restrictedAuth=null, which is the default configuration. Properly verified TLS and local Unix sockets are not exposed to this transport vector. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55857.json",
    "cwe_ids": [
        "CWE-319",
        "CWE-522"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-j

Affected ranges

Type
GIT
Repo
https://github.com/mariadb-corporation/mariadb-connector-j
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
c19f608838fdcb18fa81cab8a607afdaa5131a58
Introduced
8be57f3b4bd0b1112cf871d9426beda6919b3bb7
Fixed
defeee068496e3f6312e775c7de864f1b06388d4
Fixed
f522a2f560c6e07d1d4b9a7957ed31bc57038af4
Fixed
606bb6d6cf8fc02dc723ec468b5f753680da0993
Fixed
df4ebe2c61293b7a79ab9dd440199544305d1f38
Fixed
a8599ab1cbe4b8818ea945bf56a4e012c302b388
Fixed
f4a727c764d1cf48fd0c3d5e301dfa92503e0a58
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.14"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.3.5"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.3"
        },
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.9"
        }
    ]
}

Affected versions

1.*
1.1.8
1.1.9
1.2.0
1.2.2
1.3.0
1.3.0-beta-1
1.3.0-beta-2
1.3.0-beta-3
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.3
1.5.5
1.5.6
1.5.8
1.5.9
2.*
2.0.0-RC
2.1.2
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.7.10
2.7.11
2.7.12
2.7.13
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
3.*
3.0.0-alpha
3.0.3
3.0.6
3.0.7
3.0.8
3.0.9
3.1.3
3.1.4
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.7
3.5.8

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-55857-0460b895",
        "target": {
            "function": "isMaxscale",
            "file": "src/test/java/org/mariadb/jdbc/BaseTest.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "185210897925734049027086244423075167776",
            "length": 319.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/defeee068496e3f6312e775c7de864f1b06388d4",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-05544196",
        "target": {
            "function": "authenticationHandler",
            "file": "src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "66914322918813580665845092518585623350",
            "length": 2342.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-1739a666",
        "target": {
            "file": "src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "95927328238952572763073525914352105198",
                "137908092905516702978261083455404572829",
                "26026495220430963599103436964494878848",
                "64387958179086574582410957952177278365",
                "38805747129697450262873705073666206672",
                "303996314406764862870253161973967189653",
                "245009775004383879237758540528365454496",
                "303237372921126119918244160426321513425",
                "116555714591560352081771942586172112268",
                "323553789420858655332747044650687720321"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-2f2cb395",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/ConnectionTest.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "197367476011843974919595475387097170892",
                "139052986979486288162942667748402944149",
                "317114937133568872939909485149640795112",
                "143061225679504176903555900921739691533",
                "32274541665449519468845874060180899705",
                "3639896034999008240949427473524887338",
                "334826656259829447982166538679893298008",
                "54316010650518622515736284701127296526",
                "143642831959135808429362681583058635066",
                "93496940065405036562951482014380006151",
                "112113012811552439982739646114680578322",
                "235837048743237757919194773807104629797",
                "13713838032653712154821977287955750441",
                "89967093561096773710598397612636998155",
                "46057601821703735400212531616447787762",
                "258955082016621251869240230017760119530",
                "337177658437469896547515615993131303712",
                "112113012811552439982739646114680578322",
                "235837048743237757919194773807104629797",
                "13713838032653712154821977287955750441",
                "197748345389160646318242071148927274303",
                "284275066092141185894435478247576466723",
                "41253038402010425370473279137462501322",
                "100430308365633018953594379804554424469",
                "63152221792033553108530646232352950830",
                "293418836657686717282881239405191875855",
                "23621392595239283744617721426731156310",
                "104451991999781570090773797774628861294",
                "192472832930714593904181948278543236188"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-3975af00",
        "target": {
            "function": "pamAuthPlugin",
            "file": "src/test/java/org/mariadb/jdbc/integration/ConnectionTest.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "116891327362307902597817032940590931096",
            "length": 1956.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-49c2c95c",
        "target": {
            "function": "restart",
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxy.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "125394110267100948280344882787043056509",
            "length": 258.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-4ba2ebab",
        "target": {
            "function": "TcpProxySocket",
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "45776714546164338723462641041249279583",
            "length": 172.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-57b1c6bd",
        "target": {
            "function": "run",
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "286206149843698329108931548984761100893",
            "length": 1831.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-5b54e526",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "36080727073426881173041813986674935507",
                "313765164227671911998211239114637621924",
                "182427900561183839641512897885912926552",
                "18748215377197812477916482314913713494",
                "326836629880561258824752767660421169150",
                "134669326577623107767554211984084230369",
                "106521113647404475609534626428498840999",
                "127093795513238516185077971010441312007",
                "56529725908919675086179800335607480461",
                "37338405024323771495738158621111463575",
                "120265795765920731081143943464714656529",
                "220592647504481798153606571142269190598",
                "135818739705042006595954142288327108510",
                "122011331843447417156879060623967813612",
                "159907601509891109246439304229943076662",
                "33802407644098004969853588235889933940",
                "250209934825706533869256849015261967210",
                "10180165611358828545441238481820800450",
                "212834346401854957521920983440552735401",
                "791140364776958749155669315619166076",
                "139064770066582847583756338237549340977",
                "111911877464310049565434876779233978945",
                "321594774609313880527286188448185794172",
                "199502207441525298355629710598096598358",
                "37707325452777045990449543844442780944",
                "281530574884719255925048794541219262424",
                "286459214060737518764782150566586856711",
                "132948461189540838900000221056644710100",
                "249822736470852519968590863971879614269",
                "34326942853535270594812861105059438429",
                "284414272539814029761960672945609741080",
                "222773495349271569708503899218532563339",
                "9729861514101896943044901606940373330",
                "188488146291189372441307733007992556407",
                "132258122523427606744925274623816931681",
                "249822736470852519968590863971879614269",
                "321594774609313880527286188448185794172",
                "237786024258601652862330724871184312555",
                "302345350373462776965677230129492726038",
                "2388199116681132166371303471723905893",
                "116353898746934374757627904351828895778",
                "111911877464310049565434876779233978945",
                "45574379738724547161592875030803414249",
                "272619164285717546928115815887689865980",
                "185231575570899371475720430439458086471",
                "228739972331049026873518575240124533034",
                "286124374380645913018762924814290277228",
                "5203845429875158857575703168261928184",
                "48923195057283199900345112223702956096",
                "21934578017714404142788024947012531393",
                "147034241846726266933111612934612146907",
                "297695124607537869317260265828860813512",
                "12013061300143887006331338978698591760",
                "247054472446657027384684085108215205497",
                "292973987720881257323270487289048555562",
                "183812576523699701542514276040346460544",
                "144519087708191447236047301243032049722",
                "213531157934429060409992108638704260695",
                "162145923579123227095337208288085577738",
                "71559441021564197927130027159971801636",
                "212995715004167534551138280515283139977",
                "311783417700207935874770711517786420866",
                "268324232295078176290106445261216930810",
                "305139594093281744640475330745980177575",
                "318551564965847475033085482470490650938",
                "220337420951614415587463431259826714069",
                "192696909586776576116988866569652161854",
                "291800434925973361418919438811576385253",
                "223546901574062350602808886092972198541",
                "176816040358192686828080842518218685502",
                "54285854685218769414178712479157439816",
                "226626565849905700575738508471822099535",
                "291001845362477000441739434302895351304",
                "77262302017947235427470320575908061611",
                "140060465784639053568948441989331006507",
                "93467794650317567682927009028293101724",
                "32560000235401852851504518680724448742",
                "224485162770408943948617931171821113331",
                "12154321257645284595299422001740643185",
                "99956369956854937565959288873537634129",
                "2388199116681132166371303471723905893",
                "239710116751037206416449654653440454352",
                "210585912936909598087414701931544481935",
                "186608888182779395674068129750299962427",
                "161334761599599806820713599479122818247",
                "249822736470852519968590863971879614269",
                "275967535780645398801255054852287645826",
                "1757928844923681562295595033958700022",
                "52692077411421678799880544013545094020",
                "84867976818828499679110854996311744330",
                "120475662925348192104350581947768017674",
                "281001011996375552978131961693417349372"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-6af75013",
        "target": {
            "function": "sendRst",
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "289970532453041542688790833220504902617",
            "length": 283.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-6b389e69",
        "target": {
            "file": "src/main/java/org/mariadb/jdbc/plugin/authentication/standard/SendPamAuthPacketFactory.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "269682398810295701872471235368812000322",
                "153493229653999801725843035529414445813",
                "54625252128006196442628413675715720890"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-718800d8",
        "target": {
            "function": "pamAuthPlugin",
            "file": "src/test/java/org/mariadb/jdbc/integration/ConnectionTest.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "2154185234585386927509144703436718793",
            "length": 2073.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-79e8ffa6",
        "target": {
            "file": "src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "56992114732786410387219383647132769825",
                "307930135809387169061624309726582459695",
                "148417340711752765019189557619418927394",
                "74353526475404948834452180085416070572",
                "38805747129697450262873705073666206672",
                "235782680854264734379724680023257960924",
                "145218813675214043717928689508199279537",
                "75305471282193367946100091608421314084",
                "167278389535903926432238808646523564624",
                "84909894592415828341461759665608331292"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-7a7fff17",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxy.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283982539249216696084008895452993606702",
                "47346380725116475200665603837850942091",
                "212103373299154857707036805153242529199",
                "37020035592985614936281328248017706843"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-8c786285",
        "target": {
            "function": "authenticationHandler",
            "file": "src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "101137216981178913916731030028210157922",
            "length": 1767.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-a0aa7e42",
        "target": {
            "file": "src/main/java/org/mariadb/jdbc/plugin/authentication/addon/ClearPasswordPluginFactory.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "207890951365832993763481002839376787263",
                "275454643109539414349111656039404626839",
                "109190845329067463315168370575392492581",
                "71448898176735248689212457720476555983"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-a25b5823",
        "target": {
            "function": "kill",
            "file": "src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "63537419803687200015418309072518510864",
            "length": 368.0
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-55857-d0f1d515",
        "target": {
            "file": "src/main/java/org/mariadb/jdbc/plugin/AuthenticationPluginFactory.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "222282038902374401076875751756840393005",
                "288936722961254517365986872101126733041",
                "127575331379301611331382653109635960070",
                "258929655210710065868694056010370741437"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-d51e530c",
        "target": {
            "file": "src/main/java/org/mariadb/jdbc/plugin/authentication/standard/SendPamAuthPacket.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "334683695587240903334009947067047123659",
                "66823775383326004795087880476195757835",
                "199271456944589739689161853973910713639"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-ea269462",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/integration/ConnectionTest.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "197367476011843974919595475387097170892",
                "139052986979486288162942667748402944149",
                "317114937133568872939909485149640795112",
                "143061225679504176903555900921739691533",
                "32274541665449519468845874060180899705",
                "3639896034999008240949427473524887338",
                "334826656259829447982166538679893298008",
                "54316010650518622515736284701127296526",
                "143642831959135808429362681583058635066",
                "93496940065405036562951482014380006151",
                "112113012811552439982739646114680578322",
                "235837048743237757919194773807104629797",
                "13713838032653712154821977287955750441",
                "89967093561096773710598397612636998155",
                "46057601821703735400212531616447787762",
                "258955082016621251869240230017760119530",
                "337177658437469896547515615993131303712",
                "112113012811552439982739646114680578322",
                "235837048743237757919194773807104629797",
                "13713838032653712154821977287955750441",
                "197748345389160646318242071148927274303",
                "284275066092141185894435478247576466723",
                "41253038402010425370473279137462501322",
                "100430308365633018953594379804554424469",
                "63152221792033553108530646232352950830",
                "293418836657686717282881239405191875855",
                "23621392595239283744617721426731156310",
                "104451991999781570090773797774628861294",
                "192472832930714593904181948278543236188"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-55857-fd386a8c",
        "target": {
            "file": "src/test/java/org/mariadb/jdbc/BaseTest.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "256785738987381743653376132555694639944",
                "68727910757537263648139751933403397105",
                "299737602962380196508329329106861516084",
                "199629589759793507609483143677577197047",
                "95283212317998327544029625605673081170",
                "322788262573727276319129692285418808751",
                "194029478353950828363197234374977169676",
                "197056354458389135263618634574852168053",
                "13356345791544287112055878874098875073",
                "167882527907366622863897518138363941560",
                "53515382639599372886795338142543809582",
                "151664467116144830529837379748782198517",
                "102274171772077041731510278249774198069",
                "41804052608904477648882984701865935262",
                "199313348767260020767884016327716041457",
                "117513760966066909694289784647327715328",
                "56816739296230036131343654835708668775"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/defeee068496e3f6312e775c7de864f1b06388d4",
        "signature_type": "Line"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55857.json"
vanir_signatures_modified 
"2026-08-30T08:17:25Z"