Credential Exposure in MariaDB Connector for Node.js Affecting Multiple Versions

CVE-2026-55215

What is CVE-2026-55215?

The MariaDB Connector/Node.js is susceptible to credential exposure when SSL is enabled without proper certificate pinning. This issue allows an attacker to intercept database credentials during the authentication process. Specifically, if a server selects mysql_clear_password as the initial authentication method, it may transmit the password before verifying the certificate's fingerprint. An attacker utilizing a self-signed certificate can exploit this vulnerability to capture the database password, enabling unauthorized access. This flaw has been rectified in versions 3.3.3, 3.4.6, and 3.5.3.

References