CVE-2026-55854: Cleartext Credential Disclosure in MariaDB Connector/Node.js via Coerced Authentication Switch

The MariaDB Connector for Node.js (mariadb npm package) is a high-performance client library designed for enterprise-grade applications. It implements the MySQL/MariaDB protocol handshake to manage sessions, handle connections, and execute operations. The driver exposes a wide attack surface during the handshake sequence because it supports multiple authentication plugins, including Pluggable Authentication Modules (PAM) through the dialog plugin.

The vulnerability is classified under CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-522 (Insufficiently Protected Credentials). In vulnerable versions, the client-side implementation of the dialog protocol lacks the validation checks required to block the execution of cleartext credential exchanges over unencrypted TCP networks. This oversight allows an attacker to intercept database credentials during connection negotiation.

Under default driver configurations where SSL is disabled or unconfigured, the connection establishes over raw TCP. If a client attempts to connect to a server under these conditions, a threat actor in an active network interception position can inject a spoofed authentication command. Because the client does not check the status of transport encryption before replying to the PAM dialogue, it readily leaks the raw database password.

The underlying flaw resides within the authentication subsystem of the driver, specifically in the interaction between lib/cmd/handshake/auth/pam-password-auth.js and the main dispatching class lib/cmd/handshake/authentication.js. The database driver utilizes an object-oriented architecture where distinct authentication plugins inherit behavior from a base abstract class named PluginAuth located in lib/cmd/handshake/auth/plugin-auth.js.

The base class PluginAuth exposes a method named requireSsl(), which by default returns false. This design pattern requires child authentication handlers that transmit secrets in the clear to explicitly override requireSsl() and return true to mandate transport-layer encryption. For example, the handler for standard unencrypted authentication, ClearPasswordAuth (mysql_clear_password), correctly implemented this override.

However, the PAM dialogue implementation, represented by PamPasswordAuth, failed to override the default requireSsl() return value. Because it inherited the default false value, the central dispatch router in authentication.js assumed that the PAM dialog flow could be securely executed over any channel, including raw TCP. Consequently, when the database server requested a switch to the dialog plugin, the driver proceeded with the interactive plain-text credential exchange without validating the presence of a TLS connection or a local Unix socket.

The vulnerability was mitigated by renaming the base method requireSsl() to requireSecure() to incorporate both TLS tunnels and local Unix sockets into the trusted category, and overriding it within the PamPasswordAuth plugin class.

In the patched version of lib/cmd/handshake/auth/pam-password-auth.js, the explicit override was introduced:

// Inside PamPasswordAuth
requireSecure() {
  // PAM (dialog) transmits the password in clear text, so only run it over a secure channel.
  return true;
}

Additionally, the base class PluginAuth in lib/cmd/handshake/auth/plugin-auth.js was modified to define the fallback and evaluate transport security properties:

requireSecure() {
  return false;
}
 
isSecureConnection(opts) {
  // A connection is secure if SSL is enabled or it utilizes a local Unix socket on non-Windows systems
  return Boolean(opts.ssl) || (Boolean(opts.socketPath) && process.platform !== 'win32');
}

In lib/cmd/handshake/authentication.js, the driver intercepts authentication switch commands. The fix introduces a validation gate before initiating any plugin handshake:

if (this.plugin.requireSecure() && !this.plugin.isSecureConnection(opts)) {
  return this.throwNewError(
    `${pluginName} authentication requires TLS or a local socket`,
    true,
    info,
    '08S01',
    Errors.ER_CLEAR_PASSWORD_WITHOUT_SSL
  );
}
this.plugin.start(out, opts, info);

This defensive logic effectively terminates the connection and throws an error if a cleartext plugin is invoked over an unencrypted network connection, preventing the password from escaping the application boundary.

Exploiting this vulnerability requires the attacker to occupy an active Adversary-in-the-Middle (MITM) position or control a rogue database server that the victim application attempts to reach. The attack sequence operates purely at the protocol level without requiring prior database authentication.

First, the victim application initiates a connection to what it believes is the target database server. The adversary intercepts the TCP socket and returns a standard Initial Handshake packet containing dummy capabilities.

Second, after the client sends its initial handshake response, the attacker sends an Authentication Switch Request (0xFE) packet. The payload of this packet explicitly specifies the plugin name dialog (representing PAM authentication).

Third, upon receiving the switch request, the vulnerable client driver checks its plugin mapping and instantiates PamPasswordAuth. Because requireSecure() evaluates to false in affected versions, the driver ignores the absence of TLS. It prompts the internal system password buffer, writes the cleartext password into a network packet, and transmits it back to the intercepting adversary, exposing the credentials.

The successful exploitation of CVE-2026-55854 results in complete confidentiality compromise for the affected database account. The attacker obtains the plain-text password used by the client application to connect to the database.

Since Node.js backends often connect to MariaDB instances using high-privilege administrative service accounts (such as root or dedicated application schemas), compromised credentials can lead to unauthorized data extraction, database tampering, or complete database takeover.

Despite the severity of a cleartext credential leak, the CVSS base score is capped at 5.9 (Medium) because of the elevated attack complexity (AC:H). The attacker must either compromise local routing (via ARP spoofing or DNS hijacking) or control a server to which the client application actively attempts to connect, limiting the vector of immediate remote exploitation without network-level access.

Primary remediation requires upgrading the mariadb npm dependency to a patched version. Maintainers released fixed versions across all major release branches: 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

For environments unable to immediately apply updates, the vulnerability can be mitigated by configuring strict, verified TLS connections. Developers must ensure that connections are explicitly denied if TLS fails or if a certificate is invalid. Passing rejectUnauthorized: true inside the connection settings prevents transport-layer interception:

const mariadb = require('mariadb');
const pool = mariadb.createPool({
  host: 'db.example.com',
  user: 'pam_user',
  password: 'secure_password',
  ssl: {
    ca: fs.readFileSync('/path/to/ca-cert.pem'),
    rejectUnauthorized: true
  }
});

For microservice environments running on the same hardware, connection over local Unix domain sockets bypassing TCP entirely should be configured, as Unix sockets are intrinsically validated as secure channels by the patched driver:

const pool = mariadb.createPool({
  socketPath: '/var/run/mysqld/mysqld.sock',
  user: 'pam_user',
  password: 'secure_password'
});