Listen to this Post
How CVE-2026-55215 Works
MariaDB Connector/Node.js is a library that enables Node.js applications to connect to MariaDB and MySQL databases. When SSL/TLS is enabled but no CA or server certificate is provided, the connector is supposed to verify the server’s identity using fingerprint validation.
The vulnerability lies in the order of operations. The fingerprint check is effective and will ultimately reject the connection if it fails, but this validation occurs after the authentication exchange. Specifically, in lib/cmd/handshake/auth/handshake.js, a server that selects `mysql_clear_password` as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing `mysql_clear_password` to send the credential first.
This means credentials are transmitted to the peer before the server’s identity is validated. An active man-in-the-middle (MitM) attacker on the network path can present any certificate—including a self-signed one—and capture the account password during the handshake. Even though the connector later fails the fingerprint check and closes the connection, the password has already been disclosed. The captured credentials can subsequently be used to authenticate directly against the database server.
The vulnerability affects versions prior to 3.2.4, 3.3.0 through 3.3.2, 3.4.0 through 3.4.5, and 3.5.0 through 3.5.2. It is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
DailyCVE Form:
Platform: MariaDB Connector/Node.js
Version: <3.2.4, 3.3.0-3.3.2, 3.4.0-3.4.5, 3.5.0-3.5.2
Vulnerability: Improper Certificate Validation (CWE-295)
Severity: High (CVSS 7.5)
date: 2026-08-28
Prediction: Patch expected within 48 hours of disclosure (fixed versions already released)
What Undercode Say:
Check current MariaDB Connector/Node.js version npm list mariadb Identify vulnerable versions Vulnerable: <3.2.4, 3.3.0-3.3.2, 3.4.0-3.4.5, 3.5.0-3.5.2 Fixed: 3.2.4, 3.3.3, 3.4.6, 3.5.3 and later Upgrade to a fixed version npm install [email protected] or for specific branches: npm install [email protected] npm install [email protected] npm install [email protected]
Exploit: (Educational Purposes!)
An attacker in an active MitM position on the network path can:
1. Intercept the TLS handshake between the Node.js application and the database server
2. Present any certificate (including self-signed) to the client
3. The client proceeds with authentication via `mysql_clear_password` before fingerprint validation occurs
4. Capture the cleartext password transmitted in the handshake
5. The connection is later rejected when fingerprint validation fails, but the password is already compromised
6. Use the captured credentials to authenticate directly against the database server
Protection:
- Immediate: Upgrade to fixed versions 3.2.4, 3.3.3, 3.4.6, or 3.5.3 (or later)
- Workaround: Until upgrade is possible, explicitly configure certificate verification by providing the server/CA certificate and using a verifying SSL mode such as VERIFY_CA or VERIFY_FULL
- Best Practice: Always pin CA/server certificates when enabling SSL/TLS rather than relying solely on fingerprint validation
Impact:
- Confidentiality: Database passwords are exposed to on-path attackers
- Attack Vector: Network-based, requires active MitM position
- Authentication Bypass: Captured credentials allow direct authentication to the database server
- Affected Configuration: SSL/TLS enabled without a CA/server certificate
- No User Interaction Required: Attack can be performed without any user action
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
