{"id":"CVE-2026-55857","summary":"MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials","details":"MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysql_clear_password plugin is gated behind a secure transport, but the sibling PAM handler SendPamAuthPacketFactory, named dialog by the server, does not declare that requirement and inherits the default secure-required value false; older branches implement the same affected behavior in SendPamAuthPacket. A hostile or man-in-the-middle server can send an Authentication Switch Request for dialog over plain TCP, causing the driver to return the user's password in cleartext when sslMode=DISABLE and restrictedAuth=null, which is the default configuration. Properly verified TLS and local Unix sockets are not exposed to this transport vector. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.","aliases":["GHSA-qxvw-fvwx-5cp7"],"modified":"2026-08-30T08:17:25.153713Z","published":"2026-08-28T22:44:24.351Z","related":["CGA-948c-7qf2-8m8v"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-319","CWE-522"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55857.json"},"references":[{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3"},{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9"},{"type":"WEB","url":"https://jira.mariadb.org/browse/CONJ-1320"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55857.json"},{"type":"ADVISORY","url":"https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-qxvw-fvwx-5cp7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55857"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mariadb-corporation/mariadb-connector-j","events":[{"introduced":"0"},{"introduced":"c19f608838fdcb18fa81cab8a607afdaa5131a58"},{"introduced":"8be57f3b4bd0b1112cf871d9426beda6919b3bb7"},{"fixed":"defeee068496e3f6312e775c7de864f1b06388d4"},{"fixed":"f522a2f560c6e07d1d4b9a7957ed31bc57038af4"},{"fixed":"606bb6d6cf8fc02dc723ec468b5f753680da0993"},{"fixed":"df4ebe2c61293b7a79ab9dd440199544305d1f38"},{"fixed":"a8599ab1cbe4b8818ea945bf56a4e012c302b388"},{"fixed":"f4a727c764d1cf48fd0c3d5e301dfa92503e0a58"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.7.14"},{"introduced":"3.0.0"},{"fixed":"3.3.5"},{"introduced":"3.4.0"},{"fixed":"3.4.3"},{"introduced":"3.5.0"},{"fixed":"3.5.9"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["3.5.8","2.7.13","3.5.7","3.5.5","3.5.4","3.4.2","3.3.4","3.5.3","3.3.3","3.4.1","3.5.2","3.5.1","3.5.0","3.4.0","2.7.12","2.7.11","3.3.2","3.3.1","2.7.10","3.1.4","2.7.9","3.1.3","2.7.8","2.7.7","3.0.9","3.0.8","3.0.7","3.0.6","2.7.6","2.7.5","3.0.3","2.7.4","3.0.0-alpha","2.7.3","2.7.2","2.7.1","2.7.0","2.6.2","2.6.1","2.6.0","2.5.4","2.5.3","2.5.2","2.5.1","2.4.0","2.3.0","2.2.6","2.2.5","2.2.4","2.2.3","2.2.2","2.2.1","2.2.0","2.1.2","2.0.0-RC","1.5.9","1.5.8","1.5.6","1.5.5","1.1.9","1.5.3","1.4.4","1.4.3","1.4.2","1.4.1","1.4.0","1.3.7","1.3.6","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1","1.3.0","1.3.0-beta-3","1.3.0-beta-2","1.3.0-beta-1","1.2.2","1.2.0","1.1.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55857.json","vanir_signatures_modified":"2026-08-30T08:17:25Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/defeee068496e3f6312e775c7de864f1b06388d4","target":{"file":"src/test/java/org/mariadb/jdbc/BaseTest.java","function":"isMaxscale"},"deprecated":false,"digest":{"length":319,"function_hash":"185210897925734049027086244423075167776"},"id":"CVE-2026-55857-0460b895","signature_type":"Function"},{"source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58","target":{"file":"src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java","function":"authenticationHandler"},"deprecated":false,"digest":{"function_hash":"66914322918813580665845092518585623350","length":2342},"id":"CVE-2026-55857-05544196","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["95927328238952572763073525914352105198","137908092905516702978261083455404572829","26026495220430963599103436964494878848","64387958179086574582410957952177278365","38805747129697450262873705073666206672","303996314406764862870253161973967189653","245009775004383879237758540528365454496","303237372921126119918244160426321513425","116555714591560352081771942586172112268","323553789420858655332747044650687720321"],"threshold":0.9},"id":"CVE-2026-55857-1739a666","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58","target":{"file":"src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java"}},{"id":"CVE-2026-55857-2f2cb395","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388","target":{"file":"src/test/java/org/mariadb/jdbc/integration/ConnectionTest.java"},"deprecated":false,"digest":{"line_hashes":["197367476011843974919595475387097170892","139052986979486288162942667748402944149","317114937133568872939909485149640795112","143061225679504176903555900921739691533","32274541665449519468845874060180899705","3639896034999008240949427473524887338","334826656259829447982166538679893298008","54316010650518622515736284701127296526","143642831959135808429362681583058635066","93496940065405036562951482014380006151","112113012811552439982739646114680578322","235837048743237757919194773807104629797","13713838032653712154821977287955750441","89967093561096773710598397612636998155","46057601821703735400212531616447787762","258955082016621251869240230017760119530","337177658437469896547515615993131303712","112113012811552439982739646114680578322","235837048743237757919194773807104629797","13713838032653712154821977287955750441","197748345389160646318242071148927274303","284275066092141185894435478247576466723","41253038402010425370473279137462501322","100430308365633018953594379804554424469","63152221792033553108530646232352950830","293418836657686717282881239405191875855","23621392595239283744617721426731156310","104451991999781570090773797774628861294","192472832930714593904181948278543236188"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58","target":{"file":"src/test/java/org/mariadb/jdbc/integration/ConnectionTest.java","function":"pamAuthPlugin"},"deprecated":false,"digest":{"function_hash":"116891327362307902597817032940590931096","length":1956},"id":"CVE-2026-55857-3975af00"},{"deprecated":false,"digest":{"function_hash":"125394110267100948280344882787043056509","length":258},"id":"CVE-2026-55857-49c2c95c","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38","target":{"file":"src/test/java/org/mariadb/jdbc/integration/tools/TcpProxy.java","function":"restart"}},{"deprecated":false,"digest":{"function_hash":"45776714546164338723462641041249279583","length":172},"id":"CVE-2026-55857-4ba2ebab","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38","target":{"file":"src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java","function":"TcpProxySocket"}},{"deprecated":false,"digest":{"length":1831,"function_hash":"286206149843698329108931548984761100893"},"id":"CVE-2026-55857-57b1c6bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38","target":{"file":"src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java","function":"run"}},{"digest":{"line_hashes":["36080727073426881173041813986674935507","313765164227671911998211239114637621924","182427900561183839641512897885912926552","18748215377197812477916482314913713494","326836629880561258824752767660421169150","134669326577623107767554211984084230369","106521113647404475609534626428498840999","127093795513238516185077971010441312007","56529725908919675086179800335607480461","37338405024323771495738158621111463575","120265795765920731081143943464714656529","220592647504481798153606571142269190598","135818739705042006595954142288327108510","122011331843447417156879060623967813612","159907601509891109246439304229943076662","33802407644098004969853588235889933940","250209934825706533869256849015261967210","10180165611358828545441238481820800450","212834346401854957521920983440552735401","791140364776958749155669315619166076","139064770066582847583756338237549340977","111911877464310049565434876779233978945","321594774609313880527286188448185794172","199502207441525298355629710598096598358","37707325452777045990449543844442780944","281530574884719255925048794541219262424","286459214060737518764782150566586856711","132948461189540838900000221056644710100","249822736470852519968590863971879614269","34326942853535270594812861105059438429","284414272539814029761960672945609741080","222773495349271569708503899218532563339","9729861514101896943044901606940373330","188488146291189372441307733007992556407","132258122523427606744925274623816931681","249822736470852519968590863971879614269","321594774609313880527286188448185794172","237786024258601652862330724871184312555","302345350373462776965677230129492726038","2388199116681132166371303471723905893","116353898746934374757627904351828895778","111911877464310049565434876779233978945","45574379738724547161592875030803414249","272619164285717546928115815887689865980","185231575570899371475720430439458086471","228739972331049026873518575240124533034","286124374380645913018762924814290277228","5203845429875158857575703168261928184","48923195057283199900345112223702956096","21934578017714404142788024947012531393","147034241846726266933111612934612146907","297695124607537869317260265828860813512","12013061300143887006331338978698591760","247054472446657027384684085108215205497","292973987720881257323270487289048555562","183812576523699701542514276040346460544","144519087708191447236047301243032049722","213531157934429060409992108638704260695","162145923579123227095337208288085577738","71559441021564197927130027159971801636","212995715004167534551138280515283139977","311783417700207935874770711517786420866","268324232295078176290106445261216930810","305139594093281744640475330745980177575","318551564965847475033085482470490650938","220337420951614415587463431259826714069","192696909586776576116988866569652161854","291800434925973361418919438811576385253","223546901574062350602808886092972198541","176816040358192686828080842518218685502","54285854685218769414178712479157439816","226626565849905700575738508471822099535","291001845362477000441739434302895351304","77262302017947235427470320575908061611","140060465784639053568948441989331006507","93467794650317567682927009028293101724","32560000235401852851504518680724448742","224485162770408943948617931171821113331","12154321257645284595299422001740643185","99956369956854937565959288873537634129","2388199116681132166371303471723905893","239710116751037206416449654653440454352","210585912936909598087414701931544481935","186608888182779395674068129750299962427","161334761599599806820713599479122818247","249822736470852519968590863971879614269","275967535780645398801255054852287645826","1757928844923681562295595033958700022","52692077411421678799880544013545094020","84867976818828499679110854996311744330","120475662925348192104350581947768017674","281001011996375552978131961693417349372"],"threshold":0.9},"id":"CVE-2026-55857-5b54e526","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38","target":{"file":"src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java"},"deprecated":false},{"digest":{"function_hash":"289970532453041542688790833220504902617","length":283},"id":"CVE-2026-55857-6af75013","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38","target":{"file":"src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java","function":"sendRst"},"deprecated":false},{"target":{"file":"src/main/java/org/mariadb/jdbc/plugin/authentication/standard/SendPamAuthPacketFactory.java"},"deprecated":false,"digest":{"line_hashes":["269682398810295701872471235368812000322","153493229653999801725843035529414445813","54625252128006196442628413675715720890"],"threshold":0.9},"id":"CVE-2026-55857-6b389e69","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58"},{"source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388","target":{"file":"src/test/java/org/mariadb/jdbc/integration/ConnectionTest.java","function":"pamAuthPlugin"},"deprecated":false,"digest":{"function_hash":"2154185234585386927509144703436718793","length":2073},"id":"CVE-2026-55857-718800d8","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["56992114732786410387219383647132769825","307930135809387169061624309726582459695","148417340711752765019189557619418927394","74353526475404948834452180085416070572","38805747129697450262873705073666206672","235782680854264734379724680023257960924","145218813675214043717928689508199279537","75305471282193367946100091608421314084","167278389535903926432238808646523564624","84909894592415828341461759665608331292"],"threshold":0.9},"id":"CVE-2026-55857-79e8ffa6","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388","target":{"file":"src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java"}},{"deprecated":false,"digest":{"line_hashes":["283982539249216696084008895452993606702","47346380725116475200665603837850942091","212103373299154857707036805153242529199","37020035592985614936281328248017706843"],"threshold":0.9},"id":"CVE-2026-55857-7a7fff17","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38","target":{"file":"src/test/java/org/mariadb/jdbc/integration/tools/TcpProxy.java"}},{"deprecated":false,"digest":{"function_hash":"101137216981178913916731030028210157922","length":1767},"id":"CVE-2026-55857-8c786285","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388","target":{"file":"src/main/java/org/mariadb/jdbc/client/impl/StandardClient.java","function":"authenticationHandler"}},{"deprecated":false,"digest":{"line_hashes":["207890951365832993763481002839376787263","275454643109539414349111656039404626839","109190845329067463315168370575392492581","71448898176735248689212457720476555983"],"threshold":0.9},"id":"CVE-2026-55857-a0aa7e42","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58","target":{"file":"src/main/java/org/mariadb/jdbc/plugin/authentication/addon/ClearPasswordPluginFactory.java"}},{"source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/df4ebe2c61293b7a79ab9dd440199544305d1f38","target":{"file":"src/test/java/org/mariadb/jdbc/integration/tools/TcpProxySocket.java","function":"kill"},"deprecated":false,"digest":{"function_hash":"63537419803687200015418309072518510864","length":368},"id":"CVE-2026-55857-a25b5823","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/main/java/org/mariadb/jdbc/plugin/AuthenticationPluginFactory.java"},"deprecated":false,"digest":{"line_hashes":["222282038902374401076875751756840393005","288936722961254517365986872101126733041","127575331379301611331382653109635960070","258929655210710065868694056010370741437"],"threshold":0.9},"id":"CVE-2026-55857-d0f1d515","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58"},{"digest":{"line_hashes":["334683695587240903334009947067047123659","66823775383326004795087880476195757835","199271456944589739689161853973910713639"],"threshold":0.9},"id":"CVE-2026-55857-d51e530c","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/a8599ab1cbe4b8818ea945bf56a4e012c302b388","target":{"file":"src/main/java/org/mariadb/jdbc/plugin/authentication/standard/SendPamAuthPacket.java"},"deprecated":false},{"id":"CVE-2026-55857-ea269462","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/f4a727c764d1cf48fd0c3d5e301dfa92503e0a58","target":{"file":"src/test/java/org/mariadb/jdbc/integration/ConnectionTest.java"},"deprecated":false,"digest":{"line_hashes":["197367476011843974919595475387097170892","139052986979486288162942667748402944149","317114937133568872939909485149640795112","143061225679504176903555900921739691533","32274541665449519468845874060180899705","3639896034999008240949427473524887338","334826656259829447982166538679893298008","54316010650518622515736284701127296526","143642831959135808429362681583058635066","93496940065405036562951482014380006151","112113012811552439982739646114680578322","235837048743237757919194773807104629797","13713838032653712154821977287955750441","89967093561096773710598397612636998155","46057601821703735400212531616447787762","258955082016621251869240230017760119530","337177658437469896547515615993131303712","112113012811552439982739646114680578322","235837048743237757919194773807104629797","13713838032653712154821977287955750441","197748345389160646318242071148927274303","284275066092141185894435478247576466723","41253038402010425370473279137462501322","100430308365633018953594379804554424469","63152221792033553108530646232352950830","293418836657686717282881239405191875855","23621392595239283744617721426731156310","104451991999781570090773797774628861294","192472832930714593904181948278543236188"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-j/commit/defeee068496e3f6312e775c7de864f1b06388d4","target":{"file":"src/test/java/org/mariadb/jdbc/BaseTest.java"},"deprecated":false,"digest":{"line_hashes":["256785738987381743653376132555694639944","68727910757537263648139751933403397105","299737602962380196508329329106861516084","199629589759793507609483143677577197047","95283212317998327544029625605673081170","322788262573727276319129692285418808751","194029478353950828363197234374977169676","197056354458389135263618634574852168053","13356345791544287112055878874098875073","167882527907366622863897518138363941560","53515382639599372886795338142543809582","151664467116144830529837379748782198517","102274171772077041731510278249774198069","41804052608904477648882984701865935262","199313348767260020767884016327716041457","117513760966066909694289784647327715328","56816739296230036131343654835708668775"],"threshold":0.9},"id":"CVE-2026-55857-fd386a8c"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}