CVE-2026-55856: CWE-522: Insufficiently Protected Credentials in mariadb-corporation mariadb-connector-j

MariaDB Connector/J, used for Java applications connecting to MariaDB and MySQL databases, has an insufficiently protected credential vulnerability (CWE-522) in versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9. When connecting with sslMode=verify-full or sslMode=verify-ca, if serverSslCert or trustStore are not configured, the connector accepts an untrusted self-signed certificate via fallbackToSystemTrustStore=true and records its certFingerprint. While the OK-packet and authentication-switch paths enforce this fingerprint, the initial-handshake path does not. This flaw allows an attacker performing a man-in-the-middle attack or a hostile server to present a self-signed certificate, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected.

An attacker capable of man-in-the-middle or controlling the server can obtain the full database password sent in clear text during the initial handshake, potentially compromising database credentials. The vulnerability does not impact integrity or availability but results in high confidentiality impact due to credential exposure.

This vulnerability is fixed in MariaDB Connector/J versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9. Users should upgrade to these or later versions to remediate the issue. No other mitigations are indicated in the vendor advisory. Patch status is not explicitly stated beyond the fixed versions; users should verify with official vendor advisories for the latest remediation guidance.