MariaDB Connector/R2DBC CVE-2026-55860
MEDIUM
GHSA-c857-9x2m-cvh2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
MITM or rogue-server control requirement raises AC:H; password-only disclosure gives C:H with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 2 maven packages depend on org.mariadb:r2dbc-mariadb (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.4.1.
DescriptionCVE.org
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.
AnalysisAI
Cleartext password disclosure in MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) prior to 1.4.1 allows a network-positioned attacker posing as a database server to harvest user credentials during authentication. The connector's AuthenticationPlugin interface lacked any requireSecure() gate, so plugins transmitting credentials in cleartext - mysql_clear_password and PAM/dialog - could be triggered by a forged AuthSwitchRequest over an unencrypted plain-TCP connection, causing the client to respond with the user's database password as raw bytes on the wire. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must be simultaneously true: the application must use org.mariadb:r2dbc-mariadb in a version prior to 1.4.1, AND the database connection must be over plain TCP without TLS (sslMode set to DISABLE, absent, or defaulting to disabled) and without a Unix domain socket. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the real-world risk profile: the High attack complexity metric is the dominant mitigating factor, as exploitation requires the attacker to hold a network MITM position between the Java application and its database server, or to control a rogue endpoint that the application connects to. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade org.mariadb:r2dbc-mariadb to version 1.4.1 or later, the vendor-released patch available at https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mariadb Connector R2Dbc
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today