VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Aug 28, 2026· Updated Sep 8, 2026

CVE-2026-55856

CVE-2026-55856

Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding. The OK-packet and authentication-switch paths enforce the certificate fingerprint, but the initial-handshake path does not. HandshakeResponse.encode() can therefore build and send a mysql_clear_password response before checking certFingerprint != null && !isMitMProof(), sslMode, or whether the authentication plugin is resistant to a man-in-the-middle, and the initial path also bypasses restrictedAuth. An active man-in-the-middle or hostile server can present a self-signed certificate, claim to be MariaDB, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.mariadb.jdbc:mariadb-java-clientMaven
< 2.7.142.7.14
org.mariadb.jdbc:mariadb-java-clientMaven
>= 3.0.0, < 3.3.53.3.5
org.mariadb.jdbc:mariadb-java-clientMaven
>= 3.4.0, < 3.4.33.4.3
org.mariadb.jdbc:mariadb-java-clientMaven
>= 3.5.0, < 3.5.93.5.9

Affected products

38

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.