Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-55856
Published:August 28, 2026
Updated:September 24, 2026
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding. The OK-packet and authentication-switch paths enforce the certificate fingerprint, but the initial-handshake path does not. HandshakeResponse.encode() can therefore build and send a mysql_clear_password response before checking certFingerprint != null && !isMitMProof(), sslMode, or whether the authentication plugin is resistant to a man-in-the-middle, and the initial path also bypasses restrictedAuth. An active man-in-the-middle or hostile server can present a self-signed certificate, claim to be MariaDB, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.
Affected Packages
https://github.com/mariadb-corporation/mariadb-connector-j.git (GITHUB):
Affected version(s) >=1.1.8 <2.7.14
Fix Suggestion:
Update to version 2.7.14
https://github.com/mariadb-corporation/mariadb-connector-j.git (GITHUB):
Affected version(s) >=3.4.0 <3.4.3
Fix Suggestion:
Update to version 3.4.3
https://github.com/mariadb-corporation/mariadb-connector-j.git (GITHUB):
Affected version(s) >=3.0.0-alpha <3.3.5
Fix Suggestion:
Update to version 3.3.5
https://github.com/mariadb-corporation/mariadb-connector-j.git (GITHUB):
Affected version(s) >=3.5.0 <3.5.9
Fix Suggestion:
Update to version 3.5.9
org.mariadb.jdbc:mariadb-java-client (JAVA):
Affected version(s) >=1.1.3 <2.7.14
Fix Suggestion:
Update to version 2.7.14
org.mariadb.jdbc:mariadb-java-client (JAVA):
Affected version(s) >=3.5.0 <3.5.9
Fix Suggestion:
Update to version 3.5.9
org.mariadb.jdbc:mariadb-java-client (JAVA):
Affected version(s) >=3.0.1-beta <3.3.5
Fix Suggestion:
Update to version 3.3.5
org.mariadb.jdbc:mariadb-java-client (JAVA):
Affected version(s) >=3.4.0 <3.4.3
Fix Suggestion:
Update to version 3.4.3
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Insufficiently Protected Credentials
EPSS
Base Score:
0.22