Insecure Password Transmission in MariaDB Connector/J for Java Applications

CVE-2026-55857

What is CVE-2026-55857?

The vulnerability within MariaDB Connector/J allows for insecure transmission of passwords during authentication. Specifically, prior to certain versions, the PAM dialog authentication mechanism is susceptible to being coerced by an attacker or compromised server. When using default settings, the driver's configuration may inadvertently expose user passwords in cleartext over an insecure TCP connection. This flaw arises due to the pam dialog handler not enforcing secure transmission protocols, putting Java applications that connect to MariaDB and MySQL databases at risk of password interception. This vulnerability highlights the critical need for stringent security practices when configuring database connections.

References