MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.
PUBLISHED5.2CWE-319CWE-522
MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Problem type
- CWE-319: Cleartext Transmission of Sensitive Information
- CWE-522: Insufficiently Protected Credentials
Affected products
mariadb-corporation
mariadb-connector-r2dbc
< 1.4.1 - AFFECTED
org.mariadb
r2dbc-mariadb
< 1.4.1 - AFFECTED
References
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-c857-9x2m-cvh2
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-c857-9x2m-cvh2
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a
https://hackerone.com/reports/3784556
https://hackerone.com/reports/3784556
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1
https://jira.mariadb.org/browse/R2DBC-115
https://jira.mariadb.org/browse/R2DBC-115
GitHub Security Advisories
GHSA-c857-9x2m-cvh2
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
https://github.com/advisories/GHSA-c857-9x2m-cvh2Summary
The connector does not gate clear-text password authentication plugins on transport encryption. A hostile or man-in-the-middle MariaDB server can request a clear-text plugin over an unencrypted (plain-TCP) connection, and the driver responds with the user's password in cleartext on the wire.
Details
The driver does not require a secure transport before using clear-text-password authentication plugins. A hostile or man-in-the-middle server can issue an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP, unencrypted connection, and the driver replies with the user's password as cleartext bytes on the wire.
The root cause is that the AuthenticationPlugin interface declares no capability for a plugin to require a secure connection. Because no such gate exists, clear-text plugins run regardless of whether the connection is encrypted.
Impact
The account password is transmitted in cleartext to the peer. An on-path attacker (MITM) who presents themselves as the server can capture the password during the authentication handshake. The disclosed credentials can subsequently be used to authenticate directly against the database server.
Patches
Fixed in 1.4.1. Clear-text authentication plugins (mysql_clear_password, dialog/PAM) now require a secure connection: the AuthenticationPlugin contract can declare that a plugin requires a secure transport, and such plugins are permitted only over an encrypted connection. Upgrade to 1.4.1 or later.
Workarounds
Until you can upgrade, configure certificate verification explicitly: provide the server/CA certificate and use a verifying SSL mode (e.g. VERIFY_CA / VERIFY_FULL) so the connection is encrypted and the server's identity is established before credentials are sent.
Credit
Reported by Yalguun Tumenkhuu (@fg0x0).
github.com
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-c857-9x2m-cvh2
github.com
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a
hackerone.com
https://hackerone.com/reports/3784556
github.com
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1
jira.mariadb.org
https://jira.mariadb.org/browse/R2DBC-115
github.com
https://github.com/advisories/GHSA-c857-9x2m-cvh2
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-55860Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-55860",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-08-28T22:50:30.896Z",
"dateReserved": "2026-06-17T16:44:40.995Z",
"datePublished": "2026-08-28T22:50:30.896Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-08-28T22:50:30.896Z"
},
"title": "MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)",
"descriptions": [
{
"lang": "en",
"value": "MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1."
}
],
"affected": [
{
"vendor": "mariadb-corporation",
"product": "mariadb-connector-r2dbc",
"versions": [
{
"version": "< 1.4.1",
"status": "affected"
}
]
},
{
"vendor": "org.mariadb",
"product": "r2dbc-mariadb",
"versions": [
{
"version": "< 1.4.1",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-319: Cleartext Transmission of Sensitive Information",
"cweId": "CWE-319",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-522: Insufficiently Protected Credentials",
"cweId": "CWE-522",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-c857-9x2m-cvh2",
"name": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-c857-9x2m-cvh2",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a",
"name": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://hackerone.com/reports/3784556",
"name": "https://hackerone.com/reports/3784556",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1",
"name": "https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://jira.mariadb.org/browse/R2DBC-115",
"name": "https://jira.mariadb.org/browse/R2DBC-115",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM"
}
}
]
}
}
}