Clear-Text Password Vulnerability in MariaDB Connector/R2DBC by MariaDB

CVE-2026-55860

What is CVE-2026-55860?

The MariaDB Connector/R2DBC, a non-blocking client for MariaDB and MySQL implemented in Java, has a significant vulnerability before version 1.4.1. It allows compromised clear-text password authentication due to an oversight in the AuthenticationPlugin interface, which lacks the mechanism to mandate secure transport connections. As a result, a malicious actor could perform a man-in-the-middle attack, exposing user credentials during the authentication process. This vulnerability underscores the necessity for enforcing secure connections to protect sensitive information from unauthorized access. The issue was resolved in version 1.4.1, reinforcing the importance of regular updates to mitigate security threats.

References