CVE-2026-55856

A flaw was found in MariaDB Connector/J. An active man-in-the-middle (MITM) attacker or hostile server can exploit a vulnerability during the initial connection handshake. When a Java application connects using specific SSL modes without proper certificate configuration, the connector may accept an untrusted self-signed certificate. This allows the MITM to receive the full database password in cleartext before the connection is rejected, leading to sensitive information disclosure.

MariaDB Connector/J (the JDBC driver used to connect Java applications to MariaDB and MySQL databases) does not consistently enforce certificate identity checks on the initial TLS handshake path. When an application connects with sslMode set to verify-full or verify-ca, supplies a password, and does not configure serverSslCert or trustStore, an active network attacker can present a self-signed certificate, claim to be the database server, select the mysql_clear_password authentication plugin, and receive the database password in cleartext before the connection is rejected.

This issue is fixed upstream in MariaDB Connector/J 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

When using sslMode verify-ca or verify-full, configure serverSslCert or a trustStore so the JDBC client validates the server certificate before sending credentials. Upgrade to MariaDB Connector/J 2.7.14, 3.3.5, 3.4.3, or 3.5.9 when available in your product update stream.