{"id":"CVE-2026-55860","summary":"MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)","details":"MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.","aliases":["GHSA-c857-9x2m-cvh2"],"modified":"2026-08-30T08:17:20.506684Z","published":"2026-08-28T22:50:30.896Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-319","CWE-522"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55860.json"},"references":[{"type":"WEB","url":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1"},{"type":"WEB","url":"https://hackerone.com/reports/3784556"},{"type":"WEB","url":"https://jira.mariadb.org/browse/R2DBC-115"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55860.json"},{"type":"ADVISORY","url":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-c857-9x2m-cvh2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55860"},{"type":"FIX","url":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc","events":[{"introduced":"0"},{"fixed":"be786603ec5530414996d2396157013e095b320a"},{"fixed":"a82d2658aa0f081e2967521eb45ba91165f7ecd5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.4.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.3.0","1.2.2","1.4.0","1.2.1","1.2.0","1.1.0-beta","1.0.0","0.8.2","0.8.1"],"database_specific":{"vanir_signatures_modified":"2026-08-30T08:17:20Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["208411641326436272595082583097542222771","256178363940382890432788627402232575837","252237585395149487440269743999090585244","319779976709319787537312389145746440579","79111103307264479265986370825393411802","153424853085495374192877780318775557241","48573955869979509998969628803879668671","287973917293559817170570502068049396165","192671623972599470206364935949462667422","93568389997272580657258063168556548128","149366654916836192863379186010604941358","173681864412846272899344873090463254224","337976317712771194086952603912533988347","290689514716503432925740083998989607194","325521955583932544989122508760117189325","89597737344308093367845269143304526824","102044485028740675983707909443699590331","197281210611698744168406213794471231345","45995016575585732302838300786627979307","207619393338397441959057236912142318851","51398610567172410163864027129432300607","96987050770003810062844232683066671333","102044485028740675983707909443699590331","197281210611698744168406213794471231345","45995016575585732302838300786627979307","207619393338397441959057236912142318851","209978575366912816662853814867797129891","276667708587297851465339593038119570963"],"threshold":0.9},"id":"CVE-2026-55860-35aa5d1c","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a","target":{"file":"src/main/java/org/mariadb/r2dbc/message/flow/AuthenticationFlow.java"}},{"deprecated":false,"digest":{"function_hash":"26342603326306487433931250974963227993","length":1946},"id":"CVE-2026-55860-54f0fd07","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a","target":{"file":"src/main/java/org/mariadb/r2dbc/message/flow/AuthenticationFlow.java","function":"handle"}},{"signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a","target":{"file":"src/test/java/org/mariadb/r2dbc/integration/authentication/PamPluginTest.java","function":"pamAuthPlugin"},"deprecated":false,"digest":{"function_hash":"290173928353903330255064564889003123835","length":1276},"id":"CVE-2026-55860-82c6b442","signature_type":"Function"},{"target":{"file":"src/main/java/org/mariadb/r2dbc/message/flow/AuthenticationFlow.java","function":"handle"},"deprecated":false,"digest":{"function_hash":"222029584605154549018422341570723613059","length":1856},"id":"CVE-2026-55860-83f346d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a"},{"digest":{"line_hashes":["122214384658413220263180642556852512790","192568568950443675415724737568285049550","132532662127955588070543039072006600829"],"threshold":0.9},"id":"CVE-2026-55860-c6fef4b4","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a","target":{"file":"src/main/java/org/mariadb/r2dbc/authentication/standard/PamPluginFlow.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["122214384658413220263180642556852512790","192568568950443675415724737568285049550","132532662127955588070543039072006600829"],"threshold":0.9},"id":"CVE-2026-55860-c92dd871","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a","target":{"file":"src/main/java/org/mariadb/r2dbc/authentication/addon/ClearPasswordPluginFlow.java"}},{"id":"CVE-2026-55860-dd74c966","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a","target":{"file":"src/main/java/org/mariadb/r2dbc/authentication/AuthenticationPlugin.java"},"deprecated":false,"digest":{"line_hashes":["230437608756376384458941866845327417823","8074869361149705393999701192076043273","111477693048501118497072950264223975496"],"threshold":0.9}},{"id":"CVE-2026-55860-e3e74d38","signature_type":"Line","signature_version":"v1","source":"https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a","target":{"file":"src/test/java/org/mariadb/r2dbc/integration/authentication/PamPluginTest.java"},"deprecated":false,"digest":{"line_hashes":["221981449982241078218263455705486112648","294786987990345046002250680668497222045","310906824513383574714029094801878458830","208046779343723028772963682502169306485","221829847612400822419583463460882516850","266681465146029090212660982566308155962","4874880318333069070285597844098866288","87901556352077811708995932247546616910","291276515836422210149331241255499904399","309732121390607616611280706675150521840","204078905067592932272730491624031878403","26593795897148821350541095835608470772","99958419006116284348964970299402352621","186991866555916456834447771936146124047","187825089004883024358676963229604462695","224645986134859530461249062519169891384","333572965941821664740644666394327760411","251654558560433851312564484950581898867","152383443751559999568861044632070638780","28468083760784414457093375600475923461","329029006416386912863024615442589187590","153245406997013757227028181067914552868","315701891883438727688568834239162092809","106927887960055845662838789351700691618","220309406221229925163224943261243582220","119545913846439565812153197989657742166","10009025201635833913619456678958699148","19510221013017865100916545866172445375","65324534996529118248895344383936396209","263204722494013744904864496765473565058","1149939546670787189700463768632816125"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55860.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}