{"vulnerability": "cve-2026-55854", "sightings": [{"uuid": "43f1f7d1-1adc-4061-b258-feef831d5cfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55854", "type": "seen", "source": "https://gist.github.com/alon710/5f232ba94d0a0fcc67abaad39f7d78cc", "content": "# CVE-2026-55854: CVE-2026-55854: Cleartext Credential Disclosure in MariaDB Connector/Node.js via Coerced Authentication Switch\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55854\n\n## Summary\nCVE-2026-55854 identifies a critical security flaw in the MariaDB Connector for Node.js (mariadb npm package). When establishing connections, the driver fails to validate transport security requirements during Pluggable Authentication Modules (PAM) dialog authentication. This vulnerability allows active on-path attackers or malicious database servers to coerce the client driver into transmitting user credentials in cleartext over unencrypted TCP connections.\n\n## TL;DR\nThe MariaDB Connector for Node.js fails to verify TLS or local transport security before performing PAM dialog authentication, allowing on-path attackers to capture database passwords in cleartext.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-319, CWE-522\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00278\n- **Impact**: High Confidentiality Compromise (Credential Disclosure)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- MariaDB Connector/Node.js (mariadb npm package)\n- **mariadb**: < 3.2.4 (Fixed in: `3.2.4`)\n- **mariadb**: >= 3.3.0, < 3.3.3 (Fixed in: `3.3.3`)\n- **mariadb**: >= 3.4.0, < 3.4.6 (Fixed in: `3.4.6`)\n- **mariadb**: >= 3.5.0, < 3.5.3 (Fixed in: `3.5.3`)\n\n## Mitigation\n\n- Upgrade the mariadb npm package to secure patched versions (3.2.4, 3.3.3, 3.4.6, or 3.5.3).\n- Enforce strict TLS configuration with rejectUnauthorized: true to block man-in-the-middle proxying.\n- Use local Unix domain sockets instead of unencrypted TCP loops for same-host database deployments.\n\n**Remediation Steps:**\n1. Run 'npm install mariadb@3.5.3' or the corresponding patch level for your current major release branch.\n2. Audit existing connection configuration files to ensure ssl properties are explicitly defined and validate the CA chain.\n3. Implement static analysis (Semgrep) in application pipelines to identify connection objects that disable SSL or certificate authorization.\n\n## References\n\n- [NVD Reference](https://nvd.nist.gov/vuln/detail/CVE-2026-55854)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-55854)\n- [GitHub Security Advisory](https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-42r5-vhpq-m858)\n- [MariaDB Jira Bug Tracker](https://jira.mariadb.org/browse/CONJS-353)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55854) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T16:31:36.610023Z"}]}