CVE-2026-55856
Description
A flaw was found in MariaDB Connector/J. An active man-in-the-middle (MITM) attacker or hostile server can exploit a vulnerability during the initial connection handshake. When a Java application connects using specific SSL modes without proper certificate configuration, the connector may accept an untrusted self-signed certificate. This allows the MITM to receive the full database password in cleartext before the connection is rejected, leading to sensitive information disclosure.
Statement
MariaDB Connector/J (the JDBC driver used to connect Java applications to MariaDB and MySQL databases) does not consistently enforce certificate identity checks on the initial TLS handshake path. When an application connects with sslMode set to verify-full or verify-ca, supplies a password, and does not configure serverSslCert or trustStore, an active network attacker can present a self-signed certificate, claim to be the database server, select the mysql_clear_password authentication plugin, and receive the database password in cleartext before the connection is rejected.
This issue is fixed upstream in MariaDB Connector/J 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
Mitigation
When using sslMode verify-ca or verify-full, configure serverSslCert or a trustStore so the JDBC client validates the server certificate before sending credentials. Upgrade to MariaDB Connector/J 2.7.14, 3.3.5, 3.4.3, or 3.5.9 when available in your product update stream.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
