MariaDB Connector/Node.js CVE-2026-55854

Exploitation requires three concurrent conditions: the application must use an unpatched version of mariadb Connector/Node.js (below 3.2.4, 3.3.3, 3.4.6, or 3.5.3 depending on the active branch); the database connection must use plain TCP with sslMode=DISABLE (the default) or TLS where server identity is validated only via a self-signed-certificate fingerprint (rejectUnauthorized: false with pinning) - both are non-protective transports for this vulnerability; and the attacker must either occupy an on-path network position or induce the client to connect to an attacker-controlled server. Exploitation is fully blocked by properly verified TLS with certificate authority validation (rejectUnauthorized: true), use of a local Unix domain socket (socketPath option, non-Windows only), or upgrading to a patched release. Setting restrictedAuth to exclude the 'dialog' plugin also blocks the vector at the connector level. The default configuration (sslMode=DISABLE, restrictedAuth=null) is vulnerable on any network path not inherently controlled by the application operator.

The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly reflects high confidentiality impact offset by high attack complexity - exploitation is network-reachable but requires either an on-path MITM position or the ability to substitute a hostile database server, which is a meaningful prerequisite. EPSS data was not included in the provided intelligence and cannot be quantified. No CISA KEV listing and no public exploit code have been identified, consistent with opportunistic risk being low and targeted risk being moderate. Real-world exposure is highest in environments where Node.js applications connect to MariaDB over untrusted network segments with default connector settings - containerized deployments reaching external MariaDB endpoints or cloud-hosted applications traversing shared networks are the most plausible targets. Importantly, organizations using TLS with fingerprint-only certificate validation (rejectUnauthorized: false with pinning) receive no protection, which may affect teams who believe they are secured by TLS. The patch is low-risk, available for all active branches, and should be treated as a routine but timely upgrade rather than an emergency response.

An attacker with MITM positioning on the network path between a Node.js application and its MariaDB server intercepts the TCP handshake and issues an Authentication Switch Request specifying the 'dialog' plugin before the legitimate server can respond. The unpatched connector, lacking a transport-security check for this plugin, returns the account password in cleartext, which the attacker captures and then uses to authenticate directly to the real MariaDB server or any other service where the credential is reused. No public proof-of-concept code has been identified, but the attack is straightforward to implement given standard MITM tooling.