MariaDB Connector/C CVE-2026-107819

Exploitation requires ALL of the following concrete conditions: (1) the client uses MariaDB Connector/C libmariadb version 3.4.1 through 3.4.9 in Zero-Configuration SSL mode - i.e. no ssl_ca, ssl_capath, ssl_crl, ssl_crlpath, or TLS fingerprint (tls_fp / tls_fp_list) is configured, which is precisely the set of options the fix now checks; (2) the attacker holds a certificate that passes CA trust validation but is issued for a hostname other than the target server; (3) the attacker occupies an active man-in-the-middle position on the TLS path; and (4) the connection undergoes an authentication-plugin switch so the attacker can request the non-hashing mysql_clear_password plugin. Limiting factors that reduce realistic risk: the active-MITM requirement, the need for a validly-trusted certificate for an unrelated hostname, and the dependence on the zero-config SSL path (deployments that explicitly pin a CA, CRL, or fingerprint are not affected). Non-local connections only - the fix exempts localhost/127.0.0.1/::1 from hostname verification.

This is a genuine but conditional credential-disclosure flaw (CWE-297, improper host mismatch validation), best characterized as moderate rather than urgent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N = 5.9) is internally consistent with the description: network-reachable (AV:N), no privileges needed by the attacker (PR:N), no victim interaction (UI:N), but high complexity (AC:H) because exploitation requires an active man-in-the-middle position AND a certificate that is valid for some other hostname, plus the victim running in Zero-Configuration SSL mode. Impact is confidentiality-only (C:H / I:N / A:N) - the leaked cleartext database password. Exploitation status: no public exploit identified at time of analysis - the only GitHub source code is the remediation commit (e8c0a16), NOT weaponized exploit code, so POC availability should not be counted. No CISA KEV listing and no EPSS score were provided in the input, so real-world exploitation frequency cannot be quantified from these signals; the AC:H MITM precondition strongly suggests any real abuse would be targeted, not opportunistic or wormable. Net: a real issue worth patching on the normal cycle, not a drop-everything emergency, absent evidence of active exploitation.

An attacker who has achieved a man-in-the-middle position on the network path between an application and its MariaDB/MySQL server, and who holds a certificate that chains to a trusted CA but is issued for a different hostname, intercepts a client connection running in Zero-Configuration SSL mode. Because the libmariadb auth-switch logic validates certificate trust but fails to reject the TLS hostname mismatch before choosing a non-hashing plugin, the attacker requests mysql_clear_password and the client transmits the cleartext database password inside the attacker-controlled TLS tunnel. No public exploit exists; the mechanism is documented only by the vendor fix commit.