CVE-2026-55854: CWE-319: Cleartext Transmission of Sensitive Information in mariadb-corporation mariadb-connector-nodejs

MariaDB Connector/Node.js before versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contains a vulnerability where account passwords can be transmitted in cleartext during PAM dialog authentication if negotiated over an insecure transport. The SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked enforcement of secure transport for mysql_clear_password, allowing a malicious or man-in-the-middle server to send an Authentication Switch Request over plain TCP and receive the password in cleartext. This vulnerability is mitigated by using properly verified TLS or local Unix sockets, as fingerprint-only server identity validation is insufficient. The issue is addressed in the fixed versions.

An attacker positioned as a hostile or man-in-the-middle server can cause the connector to disclose account passwords in cleartext during PAM dialog authentication over an insecure transport. This compromises credential confidentiality but does not affect integrity or availability. Proper use of TLS or local Unix sockets prevents exploitation.

Upgrade MariaDB Connector/Node.js to version 3.2.4, 3.3.3, 3.4.6, or 3.5.3 or later, where this issue is fixed. Alternatively, ensure that connections use properly verified TLS or local Unix sockets to prevent cleartext password transmission. Fingerprint-only server identity validation is insufficient to mitigate this vulnerability. Patch status is not explicitly stated but fixed versions are known; users should update accordingly.