EUVD-2026-67869
GHSA-cqhc-2h57-wpxf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the mandatory active MitM network position; C:H for full credential disclosure; no integrity or availability impact applies.
Primary rating from Vendor (https://github.com/mariadb-corporation/mariadb-connector-nodejs).
CVSS VectorVendor: https://github.com/mariadb-corporation/mariadb-connector-nodejs
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 4 npm packages depend on mariadb (3 direct, 1 indirect)
Ecosystem-wide dependent count for version 3.3.0.
DescriptionCVE.org
Summary
When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server's identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens *after* the authentication exchange. As a result, the credentials are sent before validation occurs, so an active man-in-the-middle who presents their own certificate receives the password in the handshake before the connection is aborted.
Impact
The credentials are transmitted to the peer before the server's identity is validated. An on-path attacker (MitM) presenting any certificate can capture the account password, even though the connection then fails the fingerprint check and is closed. The disclosed credentials can subsequently be used to authenticate directly against the server.
- Attacker requirement: active man-in-the-middle position on the network path
- Affected configuration: SSL/TLS enabled without a CA / server certificate
Affected versions
- < 3.2.4
- 3.3.0 - 3.3.2
- 3.4.0 - 3.4.5
- 3.5.0 - 3.5.2
Patches
Fixed in 3.2.4, 3.3.3, 3.4.6, and 3.5.3. Upgrade to one of these (or later) on your branch.
Workarounds
Until you can upgrade, configure certificate verification explicitly, provide the server/CA certificate and use a verifying SSL mode (e.g. VERIFY_CA / VERIFY_FULL).
Reported by haaahaaahiihiiii (no GitHub account).
AnalysisAI
Credential disclosure in the MariaDB Connector for Node.js (npm: mariadb) exposes plaintext database passwords to active network attackers when SSL/TLS is configured without a CA or server certificate. Fingerprint-based server identity validation is sequenced after the authentication exchange, so a man-in-the-middle presenting any certificate receives the password before the connection is ultimately rejected and closed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be true for exploitation to succeed: the Node.js application must use the mariadb npm connector with SSL enabled (ssl: true or equivalent) but without providing an explicit CA certificate or server certificate - the precise configuration that triggers fingerprint-only validation; and the attacker must hold an active man-in-the-middle network position on the path between the application server and the MariaDB server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) overstates exploitability: AC:L does not reflect the prerequisite of an active man-in-the-middle network position, which requires ARP spoofing, DNS hijacking, rogue wireless access point control, or compromised routing infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the mariadb npm package to the patched version for your active branch: 3.2.4, 3.3.3, 3.4.6, or 3.5.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Node.js applications using the mariadb npm package and identify any instances with SSL/TLS configurations that lack proper CA or server certificate validation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today