CVE-2026-55215

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing mysql_clear_password to send the credential first. An active man-in-the-middle can present a self-signed certificate, capture the database password, and use it to authenticate directly even though the connector later rejects the server and closes the connection. This issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.

• CWE-295
• CWE-522

• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/514576a5a1fab3ea8498613e259a0b7a764e7302
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/c47d7275835c78c7eb8186cd23e9d57c045c128b
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/ecd36958e6e3bf0e0fa8389546f50c0ed6dbb2ac
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.3
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.6
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.3
• https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-cqhc-2h57-wpxf
• https://hackerone.com/reports/3777370
• https://jira.mariadb.org/browse/CONJS-349

Published

Aug 28, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55207Pimcore is an Open Source Data & Experience Management Platf…8.8
• CVE-2026-55208Pimcore Studio Backend Bundle is the backend bundle for Pimc…7.7
• CVE-2026-55209resdata is software for reading and writing result files fro…9.8
• CVE-2026-55211Surfio is a library for reading and writing surface files. P…9.8
• CVE-2026-55212Pimcore is an Open Source Data & Experience Management Platf…7.1
• CVE-2026-55213h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …7.5
• CVE-2026-55219Paymenter is a free and open-source webshop solution for man…5.3
• CVE-2026-5522IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains…6.7
• CVE-2026-55220Pimcore is an Open Source Data & Experience Management Platf…9.3
• CVE-2026-55221Boruta is a standalone authorization server that aims to imp…6.5
• CVE-2026-55223c3p0 is a JDBC Connection pooling library. In versions prior…6.3
• CVE-2026-55225Strimzi provides a way to run an Apache Kafka cluster on Kub…8