CVE-2026-55857: CWE-319: Cleartext Transmission of Sensitive Information in mariadb-corporation mariadb-connector-j

MariaDB Connector/J, used for Java applications connecting to MariaDB and MySQL, has a vulnerability (CVE-2026-55857) involving cleartext transmission of sensitive authentication information. The PAM dialog authentication handler does not enforce secure transport, allowing a hostile or man-in-the-middle server to coerce the driver into sending the user's password in cleartext over an unencrypted connection when sslMode is disabled and restrictedAuth is null. Properly verified TLS connections and local Unix sockets are not affected. This vulnerability affects versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, where the issue has been fixed.

An attacker controlling or intercepting the server connection can obtain user passwords in cleartext if the client uses default insecure settings (sslMode=DISABLE and restrictedAuth=null). This compromises credential confidentiality but does not affect integrity or availability. Secure transport configurations are not vulnerable.

Upgrade MariaDB Connector/J to version 2.7.14, 3.3.5, 3.4.3, or 3.5.9 or later where the vulnerability is fixed. Alternatively, ensure that sslMode is not set to DISABLE and that secure transport is enforced to prevent cleartext password transmission. Since this is a client-side library, users must update their connector versions and configure secure connections properly. Patch status is not explicitly stated but fixed versions are known; apply these updates accordingly.