Listen to this Post
MariaDB Connector/Node.js is a driver that enables Node.js applications to connect to MariaDB and MySQL databases. A security vulnerability, identified as CVE-2026-55854, exists in versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3. This flaw allows a malicious actor to obtain a user’s password in cleartext during the authentication process.
The root cause lies in the inconsistent enforcement of security policies for different authentication plugins. The `mysql_clear_password` plugin, which transmits passwords in cleartext, is correctly protected. The driver refuses to use it over an insecure, plain TCP connection. However, the PAM (Pluggable Authentication Modules) `dialog` plugin, handled by SendPamAuthPacketFactory, did not inherit this same secure-transport gate. It retained the default `secure-required` value of false.
This oversight creates a dangerous scenario. With default settings—where `sslMode` is set to `DISABLE` and `restrictedAuth` is null—the connection is not encrypted. An attacker positioned on the network path (a Man-in-the-Middle) can exploit this. During the initial handshake, the malicious server sends an “Authentication Switch Request”, instructing the client to use the PAM `dialog` plugin. Because this plugin lacks the secure-transport check, the connector complies and sends the user’s password in cleartext over the network.
This attack does not require any non-default options and can be triggered with the driver’s standard configuration. Connections that use properly verified TLS or a local Unix socket are not vulnerable to this attack vector. However, connections relying solely on self-signed certificate fingerprint validation are still susceptible. The vulnerability is classified as medium severity with a CVSS v3.1 base score of 5.9.
DailyCVE Form:
- Platform: MariaDB Connector/Node.js
- Version: <3.2.4, <3.3.3, <3.4.6, <3.5.3
- Vulnerability: Cleartext password disclosure
- Severity: Medium (CVSS 5.9)
- Date: 2026-08-28
- Prediction: 2026-09-04
What Undercode Say:
- Vulnerable Code Path: The flaw exists in `lib/cmd/handshake/auth/pam-password-auth.js` and
lib/cmd/handshake/authentication.js. - Misconfigured Gate: The `SendPamAuthPacketFactory` for the `dialog` plugin lacks the `secure-required` flag.
- Default Insecurity: The default `sslMode=DISABLE` and `restrictedAuth=null` settings make the attack possible.
- Patch Strategy: The fix applies the same secure-transport requirement to PAM as used for
mysql_clear_password. - Mitigation: Upgrade to version 3.2.4, 3.3.3, 3.4.6, or 3.5.3.
Affected Code Snippet (Vulnerable Logic)
// lib/cmd/handshake/auth/pam-password-auth.js
// The SendPamAuthPacketFactory does not enforce a secure transport.
// This allows the password to be sent in cleartext over plain TCP.
class SendPamAuthPacketFactory {
// Missing: this.secureRequired = true;
// ...
}
Exploit: (Educational Purposes!)
A successful exploit relies on a Man-in-the-Middle (MITM) position. The attacker’s server must be able to intercept and modify the traffic between the client and the legitimate database server.
1. Intercept Connection: The attacker positions themselves on the network path and intercepts the client’s connection attempt to the database.
2. Send Auth Switch: Instead of completing the normal authentication, the malicious server sends an `Authentication Switch Request` packet to the client.
3. Request Dialog Plugin: This request instructs the client to switch to the PAM `dialog` authentication plugin.
4. Receive Cleartext Password: The vulnerable client, lacking the secure-transport check, complies and sends the user’s password in cleartext back to the attacker’s server.
Example of a MITM setup using tools like ettercap or tcpdump to capture traffic This is a simplified illustration of the network interception point. On the attacker's machine, to capture traffic on a network interface: sudo tcpdump -i eth0 port 3306 -A The attacker would then need to craft and inject an Authentication Switch Request packet for the 'dialog' plugin. The specific packet crafting is beyond this summary.
Protection
Protecting against CVE-2026-55854 involves several strategies, with upgrading being the most definitive.
– Upgrade: The primary and most reliable fix is to upgrade to a patched version of the MariaDB Connector/Node.js. The issue is resolved in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
– Enforce TLS: If an immediate upgrade is not possible, enforce a secure connection. Set `sslMode` to `REQUIRED` or `VERIFY_CA` instead of DISABLED.
– Restrict Authentication Plugins: Use the `restrictedAuth` configuration option to explicitly disallow the `dialog` plugin from being negotiated over insecure connections.
– Avoid PAM over Plain TCP: As a workaround, avoid using PAM (dialog) authentication over plain, unencrypted TCP connections.
Impact
The successful exploitation of this vulnerability has a severe impact on the confidentiality of user credentials.
– Credential Theft: An attacker can capture the database account password in cleartext.
– Unauthorized Access: With the stolen credentials, the attacker can authenticate to the database as the compromised user.
– Lateral Movement: If the password is reused for other services or applications, the attacker can use it to gain access to those systems as well, leading to a broader security breach.
– Data Breach: Once authenticated, the attacker can access, modify, or exfiltrate sensitive data stored in the database.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
