CVE-2026-55857 MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the initial-handshake process. An attacker can intercept and obtain database credentials by performing a man-in-the-middle attack during the authentication exchange when the connection is...

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

Summary When a Java application connects with sslMode=verify-full or verify-ca and a password but does not pin a server certificate, Connector/J deliberately accepts an untrusted/self-signed certificate at the TLS layer the "MITM-proof without a CA" feature and proves the server's identity...

CVE-2026-55856

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore,...

CVE-2026-55856 MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore,...

CVE-2026-55856 MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore,...

CVE-2026-55856

MariaDB Connector/J (Java connector for MariaDB/MySQL databases) has a cleartext password disclosure vulnerability on the initial-handshake path. When an application connects with sslMode=verify-full or verify-ca, supplies a password, and does not configure serverSslCert or trustStore, the connec...

CVE-2025-64649

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

GHSA-42R5-VHPQ-M858 MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

Summary When PAM dialog authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password. Details The...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the SendPamAuthPacketFactory function. An attacker can intercept sensitive credentials by performing a man-in-the-middle attack or controlling a malicious server that issues an Authentication...

EUVD-2026-66296

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...

GHSA-7G4W-CG88-2CQ2

creationtimestamp| type| source ---|---|--- 2026-08-28 20:59:24+00:00| seen| https://bsky.app/profile/newssecia.bsky.social/post/3mu6ax42wfx2g 2026-08-28 22:00:41+00:00| seen| https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html 2026-08-29 01:00:36+00:00| seen|...

CVE-2025-64649 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

CVE-2026-55215

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the authentication. An attacker can intercept sensitive credentials by performing a man-in-the-middle attack during the initial handshake. Note: This is only exploitable if SSL/TLS is enabled...

GHSA-CQHC-2H57-WPXF MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

Summary When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server's identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens after the authentication exchange. As a result, the...

CVE-2026-55215

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215

MariaDB Connector/Node.js is vulnerable to cleartext password disclosure via a man-in-the-middle attack when ssl: true is set without a pinned CA or server certificate. The root cause lies in the TLS handshake logic: in handshake.js, a server selecting mysql_clear_password as the initial authenti...