CVE-2026-55857: Insecure Credential Transmission via PAM Dialog Plugin in MariaDB Connector/J

MariaDB Connector/J is the official Java Database Connectivity (JDBC) driver that enables Java applications to interface with MariaDB and MySQL database systems. The driver manages protocol-level communications, including connection establishment, capability negotiation, and authentication handshakes. Because these early connection phases occur before full application context is established, they present a critical attack surface.

This vulnerability, tracked as CVE-2026-55857, is classified under CWE-319 (Cleartext Transmission of Sensitive Information). The flaw lies in the driver's Pluggable Authentication Module (PAM) handler class, SendPamAuthPacketFactory, which maps to the server-side authentication plugin name dialog. While standard cleartext plugins (such as mysql_clear_password) strictly require an encrypted transport channel, the PAM handler failed to declare this requirement.

If the driver operates under its default configuration where sslMode is set to DISABLE and restrictedAuth is null, it establishes connections over unencrypted plain TCP. An adversary capable of intercepting or terminating these connections can manipulate the authentication sequence to downgrade the security profile, forcing the driver to transmit the user's cleartext password.

The root cause of this vulnerability lies in the design and implementation of the driver's authentication plugin validation framework. In MariaDB Connector/J, client-side authentication mechanisms are defined by classes implementing the AuthenticationPluginFactory interface. To safeguard sensitive data, this interface exposes validation properties that connection dispatchers query before transmitting credentials.

In modern 3.x branches, this is governed by the requireSecure() method, while older 2.x branches rely on the requireSsl() method. Both methods default to returning false unless explicitly overridden by the implementing subclass. The ClearPasswordPluginFactory (which implements mysql_clear_password) correctly overrides this property to return true, blocking unencrypted transmission.

However, the PAM handler subclass—SendPamAuthPacketFactory in 3.x and SendPamAuthPacket in 2.x—omitted this override and inherited the default false value. When a database server issues an AuthSwitchPacket demanding dialog authentication, the client's dispatcher (StandardClient.java) checks if the plugin requires a secure connection. Because the PAM handler's check evaluated to false, the dispatcher authorized the transaction over the unencrypted TCP socket, directly violating transport-layer security requirements for cleartext-transmitting credentials.

To resolve the vulnerability, the developers overridden the security requirements in the PAM plugin classes and strengthened the validation logic in the driver's central connection dispatcher.

In the modern 3.x branch, SendPamAuthPacketFactory.java was patched to override the requireSecure() method:

// Patched in SendPamAuthPacketFactory.java
@Override
public boolean requireSecure() {
  return true;
}

In the legacy 2.x branch, a similar patch was applied to SendPamAuthPacket.java to enforce secure transports:

// Patched in SendPamAuthPacket.java
@Override
public boolean requireSsl() {
  // PAM ("dialog") sends the password to the server in clear text, exactly like
  // mysql_clear_password. It must therefore only run over a secure channel (TLS, or a local
  // unix socket - handled by the dispatcher).
  return true;
}

Additionally, the connection dispatcher within StandardClient.java was updated. Previously, the validation routine only checked if SSL capability was present on the client. The updated logic permits secure-required authentication only if TLS/SSL is active or if the connection is established over a local Unix domain socket (represented by UnixDomainSocket class), which is secure from remote network-level sniffing:

// Enforcement implementation in StandardClient.java
if (authPluginFactory.requireSecure()
    && !context.hasClientCapability(SSL)
    && !(socket instanceof UnixDomainSocket)) {
  throw context
      .getExceptionFactory()
      .create(
          "Cannot use authentication plugin "
              + authPluginFactory.type()
              + " if SSL is not enabled (a clear-text password plugin requires TLS or a"
              + " local unix socket).",
          "08000");
}

This two-pronged remediation ensures that any unencrypted TCP connection attempting to negotiate the dialog PAM auth mechanism is aborted immediately before the client can write credential bytes to the socket.

Exploiting CVE-2026-55857 requires the attacker to occupy an Adversary-in-the-Middle (AiTM) network position or redirect client traffic to an attacker-controlled rogue database server. The default parameters of the client application (sslMode=DISABLE and restrictedAuth=null) satisfy the primary exploitation prerequisites.

When the client application attempts to establish a connection, the adversary intercepts the TCP socket. After the initial handshake exchange, the attacker sends an AuthSwitchPacket indicating that the authentication process must switch to the dialog plugin.

Because the unpatched driver does not flag the dialog plugin as requiring a secure transport, the client dispatcher accepts the transition. The PAM plugin then serializes the user's database password and transmits it across the unencrypted TCP session. The attacker captures the cleartext payload, achieving complete credential disclosure.

The impact of a successful credential interception is critical. An attacker who harvests database passwords can gain unauthorized read, write, and administrative access to the backend databases. This can lead to database deletion, unauthorized data extraction, and the modification of records.

The vulnerability is assigned a CVSS v3.1 base score of 5.9 (Medium). Although the payload results in direct plaintext credential leakage (High Confidentiality Impact), successful exploitation requires an on-path network position or the ability to manipulate connection strings (High Attack Complexity).

If the database credentials are recycled across the organization (e.g., matching LDAP or Active Directory service accounts mapped to the database PAM backend), the disclosure of these credentials can serve as a primary vectors for broader lateral movement across the enterprise network.

The primary recommendation is to update the MariaDB Connector/J dependency within your application classpath to a patched release. The fix is backported across all actively maintained versions of the driver:

• For 2.7.x deployments: Upgrade to 2.7.14 or newer.
• For 3.3.x deployments: Upgrade to 3.3.5 or newer.
• For 3.4.x deployments: Upgrade to 3.4.3 or newer.
• For 3.5.x deployments: Upgrade to 3.5.9 or newer.

If an immediate dependency upgrade is not feasible, implement configuration-based mitigations to block the vulnerability. First, enforce strict SSL verification to prevent Adversary-in-the-Middle positioning:

sslMode=verify-full&serverSslCert=/path/to/trusted-ca.pem

Second, restrict the authentication mechanisms permitted by the client. By setting the restrictedAuth connection property, you can explicitly forbid the driver from negotiating the PAM 'dialog' plugin, neutralizing the switch-request attack vector:

restrictedAuth=mysql_native_password,caching_sha2_password