CVE-2026-55215: MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`
When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server’s identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens after the authentication exchange. As a result, the credentials are sent before validation occurs, so an active man-in-the-middle who presents their own certificate receives the password in the handshake before the connection is aborted.
References
- github.com/advisories/GHSA-cqhc-2h57-wpxf
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/514576a5a1fab3ea8498613e259a0b7a764e7302
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/c47d7275835c78c7eb8186cd23e9d57c045c128b
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/ecd36958e6e3bf0e0fa8389546f50c0ed6dbb2ac
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.3
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.6
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.3
- github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-cqhc-2h57-wpxf
- hackerone.com/reports/3777370
- jira.mariadb.org/browse/CONJS-349
- nvd.nist.gov/vuln/detail/CVE-2026-55215
Code Behaviors & Features
Detect and mitigate CVE-2026-55215 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →