https://vulnerability.circl.lu/sightings/feed 2026-08-29T06:56:12.710349+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1bd87355-028f-4d65-81de-0ccbf67a779a/export 2026-08-29T06:56:12.735400+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "1bd87355-028f-4d65-81de-0ccbf67a779a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55857", "type": "seen", "source": "https://gist.github.com/alon710/3380ae01f52344248b245161333046b0", "content": "# CVE-2026-55857: CVE-2026-55857: Insecure Credential Transmission via PAM Dialog Plugin in MariaDB Connector/J\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55857\n\n## Summary\nA transport-security omission in the MariaDB Connector/J driver allows remote on-path adversaries or rogue database servers to capture database credentials in cleartext. Under default configurations (sslMode=DISABLE), the driver fails to enforce encrypted channels when negotiating the Pluggable Authentication Module (PAM) 'dialog' plugin, resulting in cleartext transmission of sensitive passwords.\n\n## TL;DR\nMariaDB Connector/J fails to enforce TLS/SSL when negotiating the PAM 'dialog' authentication plugin. An attacker with on-path network access or running a rogue database server can trigger an authentication switch to 'dialog' and harvest the database password in plaintext.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-319: Cleartext Transmission of Sensitive Information\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **CVSS Base Score**: 5.9 (Medium)\n- **Impact**: High Confidentiality Loss (C:H)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing MariaDB Connector/J (mariadb-java-client) to connect to MariaDB or MySQL servers.\n- **mariadb-connector-j**: < 2.7.14 (Fixed in: `2.7.14`)\n- **mariadb-connector-j**: >= 3.0.0, < 3.3.5 (Fixed in: `3.3.5`)\n- **mariadb-connector-j**: >= 3.4.0, < 3.4.3 (Fixed in: `3.4.3`)\n- **mariadb-connector-j**: >= 3.5.0, < 3.5.9 (Fixed in: `3.5.9`)\n\n## Mitigation\n\n- Upgrade the MariaDB Connector/J dependency to a patched version (2.7.14, 3.3.5, 3.4.3, or 3.5.9).\n- Configure the JDBC connection string with sslMode=verify-full or sslMode=verify-ca to prevent on-path connection tampering.\n- Restrict allowed client-side authentication mechanisms via the restrictedAuth parameter to exclude 'dialog'.\n\n**Remediation Steps:**\n1. Identify all internal applications importing org.mariadb.jdbc:mariadb-java-client.\n2. Update the project build files (pom.xml, build.gradle) to reference the corresponding secure release (e.g., 3.5.9).\n3. For applications that cannot be immediately updated, append restrictedAuth=mysql_native_password to the JDBC connection string.\n4. Ensure production environment database connection strings do not use sslMode=DISABLE or sslMode=trust over public or untrusted networks.\n\n## References\n\n- [GHSA-qxvw-fvwx-5cp7 Advisory](https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-qxvw-fvwx-5cp7)\n- [MariaDB JIRA CONJ-1320 Ticket](https://jira.mariadb.org/browse/CONJ-1320)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55857) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T04:33:12.849687Z"} 2026-08-29T04:33:12.849687+00:00