CVE-2026-55854

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55854

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55854.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-55854

Aliases

Downstream

CGA (4)

Published

2026-08-28T22:03:30Z

Modified

2026-10-22T10:31:13Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb

Details

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-319",
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55854.json"
}

References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-nodejs

Affected ranges

Type

GIT

Repo

https://github.com/mariadb-corporation/mariadb-connector-nodejs

Events

Introduced

Fixed

e0064ca9171b0046ad4be1a1dc1771e7dd0bcd96

Fixed

14e0f16bd78584b3b24db33c1c6e62e3a3d241a2

Introduced

b65aca10b77f5ede83f16a8edd0537b2ef12a16f

Fixed

07e6f631a6052649b72e9aa024583d305ac7611d

Introduced

24a58245cba201da91f41f7f96f8dd165d31c6c7

Fixed

1d50f7210af2e01bf90b155e073f041952901839

Fixed

29733403cfe6519cdfe9c36c93765a468fbe285d

Fixed

53b304264df84496d331dba2765c3634602f342e

Fixed

9781de636841d34afdd08d81dd07d43edb82f85c

Fixed

fbc159c2c8bd18c2db2d2e6587ab3020bbda64b6

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.2.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "3.5.0"
                },
                {
                    "fixed": "3.5.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.3.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "fixed": "3.4.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "29733403cfe6519cdfe9c36c93765a468fbe285d"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "53b304264df84496d331dba2765c3634602f342e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "9781de636841d34afdd08d81dd07d43edb82f85c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "fbc159c2c8bd18c2db2d2e6587ab3020bbda64b6"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "3.2.4",
            "range": [
                {
                    "fixed": "e0064ca9171b0046ad4be1a1dc1771e7dd0bcd96"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "3.3.3",
            "range": [
                {
                    "fixed": "07e6f631a6052649b72e9aa024583d305ac7611d"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "3.4.6",
            "range": [
                {
                    "fixed": "1d50f7210af2e01bf90b155e073f041952901839"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "3.5.3",
            "range": [
                {
                    "fixed": "14e0f16bd78584b3b24db33c1c6e62e3a3d241a2"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.7.0

2.*

2.0.3

2.0.5

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.2.0

2.3.0

2.4.0

2.4.1

2.4.2

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.6

3.*

3.0.0-ga

3.2.0

3.2.1

3.2.2

3.2.3

3.3.0

3.3.1

3.3.2

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.5.0-rc.0

3.5.1

3.5.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55854.json"