CVE-2026-55860: Cleartext Password Disclosure in MariaDB Connector/R2DBC

The MariaDB Connector/R2DBC is a reactive, non-blocking Java driver used to communicate with MariaDB and MySQL databases. It manages connection handshakes, including protocol negotiation and authentication flows. The driver exposes an attack surface during the initial connection setup where authentication plugins are executed.

The vulnerability occurs because the client-side driver does not evaluate the encryption state of the underlying network transport before running clear-text password authentication plugins, such as mysql_clear_password or dialog (PAM). This behavior violates standard transport security practices by permitting sensitive authentication credentials to be sent without encryption over plain TCP connections.

An attacker capable of manipulating network traffic or hosting a rogue database server can exploit this omission. By issuing an authentication method switch request, the attacker can force the client to transmit the user's plain-text password across the wire, compromising the credentials.

The root cause of this flaw is an architectural gap in the AuthenticationPlugin interface of the org.mariadb:r2dbc-mariadb driver. Prior to version 1.4.1, this interface lacked the native capability to check if transport-level security was active before executing an authentication flow.

Under standard database protocols, a database server can send an AuthSwitchRequest packet (type 0xFE) to request a change of authentication mechanism. The client is designed to dynamically load the requested plugin and process the handshake. When a server requested mysql_clear_password or dialog, the driver loaded the corresponding ClearPasswordPluginFlow or PamPluginFlow without verifying if the connection was secure.

Because the driver lacked a security boundary gating these plugins, it proceeded to invoke the plugin's next() method over plain TCP. The plugin then retrieved the raw, unhashed password from the driver's configuration and transmitted it onto the wire, leading to credential disclosure.

The vulnerability was resolved by introducing a security validation contract within the AuthenticationPlugin interface and implementing enforcement inside the handshake flow.

The patch introduced the requireSecure() default method to the AuthenticationPlugin interface:

public interface AuthenticationPlugin {
  AuthenticationPlugin create();
 
  /**
   * Whether this authentication plugin requires a secure connection (TLS or a local unix socket).
   * Plugins that transmit the password in clear text return true.
   */
  default boolean requireSecure() {
    return false;
  }
 
  ClientMessage next(
      MariadbConnectionConfiguration configuration,
      byte[] seed,
      ...

The clear-text authentication plugins, including ClearPasswordPluginFlow and PamPluginFlow, were updated to override this method and return true:

@Override
public boolean requireSecure() {
  return true;
}

The AuthenticationFlow orchestrator now uses these checks to block execution over unencrypted links by throwing a R2dbcPermissionDeniedException if a secure transport is not active:

private boolean isSecureConnection() {
  return configuration.getSslConfig().getSslMode() != SslMode.DISABLE
      || configuration.getSocket() != null;
}
 
// Enforcement during AuthSwitchRequest handling
if (authPlugin.requireSecure() && !flow.isSecureConnection()) {
  sink.error(clearTextRefusal(plugin));
} else {
  flow.authMoreDataPacket = null;
  flow.pluginHandler = authPlugin;
  sink.next(AUTH_SWITCH);
}

Exploitation of this vulnerability requires the attacker to occupy an active Man-in-the-Middle (MITM) position on the network or trick the client into connecting to a rogue database server. Purely passive eavesdropping is insufficient to trigger the payload, but allows capture once the flow is initiated.

In a MITM scenario, the client attempts to establish a plain TCP connection to a legitimate MariaDB or MySQL database server. The attacker intercepts the TCP stream during the handshake. When the handshake starts, the attacker injects an AuthSwitchRequest packet specifying the mysql_clear_password plugin.

Upon receiving the forged request, the vulnerable R2DBC driver loads the clear-text plugin and executes its authentication steps. The client serializes the plain-text password and writes it to the TCP socket, where the attacker sniffs the payload. The attacker harvests the password and optionally terminates or proxies the connection.

The security impact of CVE-2026-55860 is high, resulting in a complete loss of credential confidentiality. An attacker who successfully exploits this flaw obtains the database password in plaintext.

The vulnerability is assigned a CVSS v3.1 base score of 5.9 (Medium). The score reflects the fact that while the impact on confidentiality is high, the attack complexity is also high due to the requirement for active network-level interception or dns redirection.

In enterprise environments where the R2DBC driver is used for microservices, a compromised database password can allow unauthorized access to database systems, enabling data exfiltration, integrity tampering, or lateral movement within the network.

The recommended remediation is upgrading the MariaDB Connector/R2DBC dependency to version 1.4.1 or later. This version contains the native security gates that prevent clear-text authentication over insecure channels.

If upgrading is not immediately possible, apply network-level mitigations. Configure the client's sslMode connection parameter to a secure setting such as VERIFY_CA or VERIFY_FULL. This forces TLS validation and prevents MITM attackers from intercepting or injecting handshake packets.

Additionally, enforce network segmentation to restrict database outbound traffic. Ensure the client only communicates with the database over trusted local Unix domain sockets or secure, encrypted VPN and IPsec tunnels.