CVE-2026-107819: CWE-297: Improper Validation of Certificate with Host Mismatch in MariaDB server

MariaDB Connector/C, a client library for MariaDB and MySQL databases, had an improper validation of certificates with host mismatch in its Zero-Configuration SSL authentication-switch logic from versions 3.4.1 until 3.4.10. While the library checked for certificate trust failure, it did not reject TLS hostname verification mismatches before selecting a non-hashing authentication plugin. This allowed an active man-in-the-middle attacker possessing a valid certificate for a different hostname to request the mysql_clear_password authentication method and retrieve the database password within the attacker-controlled TLS session. Other MariaDB connectors are not affected by this vulnerability. The issue was resolved in version 3.4.10.

An attacker capable of performing a man-in-the-middle attack with a valid certificate for a hostname different from the intended server can bypass hostname verification and obtain the database password via the mysql_clear_password authentication method. This compromises the confidentiality of database credentials but does not affect data integrity or availability.

Upgrade MariaDB Connector/C to version 3.4.10 or later, where the vulnerability is fixed. No other mitigation is required as the issue is resolved in this official fix.