Skip to content
Fencer Vulns
medium 5.9

CVE-2026-55856 json

MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake

published 2026-08-28 2 mo ago modified 2026-09-10 1 mo ago also GHSA-g9jj-cgmh-9f38 , EUVD-2026-68019

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding. The OK-packet and authentication-switch paths enforce the certificate fingerprint, but the initial-handshake path does not. HandshakeResponse.encode() can therefore build and send a mysql_clear_password response before checking certFingerprint != null && !isMitMProof(), sslMode, or whether the authentication plugin is resistant to a man-in-the-middle, and the initial path also bypasses restrictedAuth. An active man-in-the-middle or hostile server can present a self-signed certificate, claim to be MariaDB, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

Patch / fix

  • maven org.mariadb.jdbc:mariadb-java-client 2.7.14, 3.3.5, 3.4.3, 3.5.9

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-55856 updated cvss 5.9

org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat build of Debezium 3 mariadb-java-client 3.5.3.redhat-00001 Red Hat Build of Keycloak rhbk/keycloak-rhel9, keycloak/rhbk-openshift-rhel9, mariadb-java-client 3.5.3.redhat-00001 Red Hat build of Quarkus mariadb-java-client 3.5.3.redhat-00001 Red Hat Enterprise Linux 8 Judy, galera, mariadb, mariadb-pam, mariadb-test, mariadb-backup, +8 more Red Hat Enterprise Linux 9 mariadb-java-client 3.4.0-2.el10 Red Hat Enterprise Linux 10 mariadb-java-client 3.4.0-2.el10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Fuse 7 mariadb-java-client 3.5.3.redhat-00001
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-trustyai-service-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift GitOps microshift-gitops, openshift-gitops-argocd-cli, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Satellite 6 candlepin, candlepin-selinux
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Single Sign-On 7 mariadb-java-client 3.5.3.redhat-00001
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-rhel10 Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9
    affected: workaround, no fix available
show 2 more
  • Red Hat build of Quarkus 3.27.6.redhat mariadb-java-client 3.5.9.redhat-00001
    fixed: vendor fix RHSA-2026:83082
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator Red Hat build of Quarkus 3.27.6.redhat jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1009 more Red Hat Enterprise Linux 8 Judy, galera, grafana, mariadb, mozjs60, mariadb-pam, +23 more Red Hat Enterprise Linux 9 npm, nodejs, grafana, nodejs-libs, grafana-selinux, nodejs-full-i18n Red Hat Enterprise Linux 10 grafana, nodejs22, nodejs24, nodejs26 Red Hat Hardened Images yarnpkg, nodejs20, nodejs22, nodejs24, nodejs25, nodejs26, +7 more
    +2 more products
    Red Hat Trusted Artifact Signer rhtas/rhtas-console-ui-rhel9 Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.mariadb.jdbc:mariadb-java-client
<2.7.14
>=3.0.0, <3.3.5
>=3.4.0, <3.4.3
>=3.5.0, <3.5.9
2.7.14
3.3.5
3.4.3
3.5.9

Affected products

  • mariadb-corporation mariadb-connector-j

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.