CVE-2026-55215: CWE-295: Improper Certificate Validation in mariadb-corporation mariadb-connector-nodejs

MariaDB Connector/Node.js versions before 3.3.3, 3.4.6, and 3.5.3 improperly validate server certificates when SSL is enabled without pinned CA or server certificates. Specifically, the connector sends credentials before completing certificate fingerprint validation during the handshake process. An attacker performing a man-in-the-middle attack can present a self-signed certificate, capture the password sent via the mysql_clear_password authentication plugin, and use it to authenticate directly, even though the connector eventually rejects the server and closes the connection. This vulnerability is tracked as CVE-2026-55215 and relates to CWE-295 (Improper Certificate Validation) and CWE-522 (Insufficiently Protected Credentials).

An attacker capable of man-in-the-middle interception can capture database credentials by exploiting the premature sending of credentials before certificate validation completes. This compromises the confidentiality of the database password, potentially allowing unauthorized access to the database. The vulnerability does not affect integrity or availability directly but exposes sensitive credentials.

Upgrade MariaDB Connector/Node.js to version 3.3.3, 3.4.6, or 3.5.3 or later, where this issue is fixed. Until upgraded, avoid enabling SSL without pinned CA or server certificates to prevent exposure of credentials before certificate validation completes.