Bug 2525813 (CVE-2026-55856)

Summary:	CVE-2026-55856 org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abarbaro, abuckta, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, anthomas, ant, anujha, aoconnor, aos-team-art-private, aruklets, aschwart, asdas, asoldano, aszczucz, ataylor, avibelli, bbaranow, bbrownin, bgeorges, bmaxwell, bniver, boliveir, bparees, brasmith, bstansbe, ccranfor, cdrage, cescoffi, cmah, cmyers, cochase, dandread, dbosanac, dbruscin, dhanak, dkreling, dkuc, dlofthou, dmayorov, dnakabaa, doconnor, dpaolell, dranck, drichtar, drosa, dschmidt, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, ehelms, ehugonne, flucifre, fmariani, gbenhaim, ggainey, gmalinko, gmeno, gparvin, groman, gsmet, hasun, ibolton, istudens, ivassile, iweiss, janstey, jchui, jdelft, jfula, jhe, jjoyce, jlanda, jlledo, jmartisk, jmatsuok, jmatthew, jmontleo, jowilson, jpasqual, jpechane, jprabhak, jpretori, jreimann, jschluet, jtolenti, jupierce, juwatts, jwong, jwon, kaycoth, kingland, kshier, ktsao, kvanderr, lball, lchilton, lcouzens, lgarciaa, lhh, lthon, manderse, mbenjamin, mbiarnes, mburns, mcarlett, mdellweg, mdessi, mgarciac, mhackett, mhulan, mnovotny, mosmerov, mposolda, mrizzi, mstipich, msvehla, nboldt, ngough, niyer, nmoumoul, nwallace, nyancey, oaljalju, olubyans, omaciel, ometelka, orabin, osousa, pantinor, pberan, pcattana, pcreech, pdelbell, pesilva, pgaikwad, pgallagh, pjindal, pmackay, ppalepu, ppostler, prdhamdh, probinso, psrna, ptisnovs, rchan, rexwhite, rguimara, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rruss, rstancel, rstepani, rsvoboda, rushinde, sausingh, sbiarozk, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, smallamp, sostapov, sseago, ssilvert, stcannon, sthirugn, sthorger, suppawar, syedriko, tcunning, teagle, thjenkin, tmalecek, tqvarnst, tsedmik, ttakamiy, twaugh, vdosoudi, vereddy, veshanka, vlaad, vmuzikar, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in MariaDB Connector/J. An active man-in-the-middle (MITM) attacker or hostile server can exploit a vulnerability during the initial connection handshake. When a Java application connects using specific SSL modes without proper certificate configuration, the connector may accept an untrusted self-signed certificate. This allows the MITM to receive the full database password in cleartext before the connection is rejected, leading to sensitive information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2527628, 2527629, 2527630, 2527631, 2527634, 2527636, 2527638, 2527639, 2527642, 2527643, 2527644, 2527651, 2527632, 2527633, 2527641, 2527645, 2527646, 2527647
Bug Blocks:

Description OSIDB Bzimport 2026-08-28 22:51:18 UTC

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding. The OK-packet and authentication-switch paths enforce the certificate fingerprint, but the initial-handshake path does not. HandshakeResponse.encode() can therefore build and send a mysql_clear_password response before checking certFingerprint != null && !isMitMProof(), sslMode, or whether the authentication plugin is resistant to a man-in-the-middle, and the initial path also bypasses restrictedAuth. An active man-in-the-middle or hostile server can present a self-signed certificate, claim to be MariaDB, select mysql_clear_password as the initial authentication plugin, and receive the full database password before the connection is rejected. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.