{"vulnerability": "cve-2026-107819", "sightings": [{"uuid": "4aa25752-df8f-4af7-bf51-d5019a597752", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107819", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412161728823634", "content": "CVE-2026-107819 MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107819https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10https://jira.mariadb.org/browse/CONC-846#mariadb #MariaDB #server#CVE_2026_107819#bot", "creation_timestamp": "2026-10-09T17:36:49.681860Z"}]}