Certificate Validation Flaw in MariaDB Connector/J Affects Multiple Versions
CVE-2026-55856
What is CVE-2026-55856?
The MariaDB Connector/J enables secure connections to MariaDB and MySQL databases, but it contains a vulnerability affecting versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9. When configured with sslMode set to verify-full or verify-ca and without an appropriate serverSslCert or trustStore, the Connector/J allows an untrusted self-signed certificate to be accepted via the fallbackToSystemTrustStore=true setting. This flaw could enable a hostile entity to impersonate a MariaDB server, potentially capturing sensitive database passwords through a mysql_clear_password response before the system performs adequate security checks. The issue has been addressed in the updated versions.
Affected Version(s)
mariadb-connector-j < 2.7.14 < 2.7.14
mariadb-connector-j >= 3.0.0, < 3.3.5 < 3.0.0, 3.3.5
mariadb-connector-j >= 3.4.0, < 3.4.3 < 3.4.0, 3.4.3