Bug 2525814 (CVE-2026-55857) - CVE-2026-55857 org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication
Summary: CVE-2026-55857 org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Inf...
Keywords:
Status: NEW
Alias: CVE-2026-55857
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2527751 2527753 2527755 2527757 2527758 2527759 2527760 2527761 2527762 2527763 2527764 2527767 2527768 2527752 2527754 2527765 2527766 2527769
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-28 22:51 UTC by OSIDB Bzimport
Modified: 2026-09-02 20:50 UTC (History)
65 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-28 22:51:22 UTC
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysql_clear_password plugin is gated behind a secure transport, but the sibling PAM handler SendPamAuthPacketFactory, named dialog by the server, does not declare that requirement and inherits the default secure-required value false; older branches implement the same affected behavior in SendPamAuthPacket. A hostile or man-in-the-middle server can send an Authentication Switch Request for dialog over plain TCP, causing the driver to return the user's password in cleartext when sslMode=DISABLE and restrictedAuth=null, which is the default configuration. Properly verified TLS and local Unix sockets are not exposed to this transport vector. This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.


Note You need to log in before you can comment on or make changes to this bug.