CVE-2026-55860: CWE-319: Cleartext Transmission of Sensitive Information in mariadb-corporation mariadb-connector-r2dbc

MariaDB Connector/R2DBC, a Java client for MariaDB and MySQL, before version 1.4.1, lacks the capability for authentication plugins to require secure transport. Consequently, a hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest to use cleartext password authentication plugins (mysql_clear_password or PAM dialog) over an unencrypted connection. The AuthenticationFlow permits these plugins to transmit the user's password in cleartext bytes on the wire, exposing credentials to interception. This vulnerability is addressed in version 1.4.1.

An attacker controlling or intercepting the MariaDB server connection can obtain user passwords in cleartext during authentication over unencrypted channels. This credential disclosure can lead to unauthorized access to the database server. The CVSS score of 5.9 (medium severity) reflects the network attack vector with high impact on confidentiality but no impact on integrity or availability.

Upgrade to MariaDB Connector/R2DBC version 1.4.1 or later, where this issue is fixed. Until then, avoid using cleartext password authentication plugins over unencrypted connections. Employ transport encryption (e.g., TLS) to protect credentials in transit. Patch status is not explicitly stated beyond the fix in 1.4.1; verify vendor advisories for updates.