CVE-2025-30706

Overview

MySQL Connector/J is the official JDBC Type 4 driver for MySQL, developed and released by the MySQL team at Oracle. It lets Java applications connect to and query MySQL servers over JDBC, and also implements the X DevAPI for document-store access. It is distributed as the Maven artifact com.mysql:mysql-connector-j and is a standard dependency in Java applications that talk to MySQL.

An incorrectly configured access control vulnerability (CVE-2025-30706) has been identified in the Kerberos and LDAP SASL GSSAPI authentication plugins of MySQL Connector/J, which allows attackers to have arbitrary JAAS login modules run inside the driver during authentication. Successful attacks can result in takeover of MySQL Connector/J.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of MySQL Connector/J.

Details

Module Info

• Product: MySQL Connector/J
• Affected packages: com.mysql:mysql-connector-j
• Affected versions: >=9.0.0 <=9.2.0
• GitHub repository: https://github.com/mysql/mysql-connector-j
• Published packages: https://central.sonatype.com/artifact/com.mysql/mysql-connector-j
• Package manager: Maven
• Fixed in:
  • OSS MySQL Connector/J 9.3.0
  • NES for MySQL Connector/J v8.0.35

Vulnerability Info

This High-severity vulnerability is found in the com.mysql:mysql-connector-j package in multiple versions of MySQL Connector/J. Oracle rates it CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

The authentication_kerberos_client plugin (AuthenticationKerberosClient) and the LDAP SASL GSSAPI plugin (AuthenticationLdapSaslClientPlugin) log in to Kerberos through JAAS under the driver's MySQLConnectorJ login entry. Each plugin builds an in-memory configuration that uses only com.sun.security.auth.module.Krb5LoginModule, but only when the java.security.auth.login.config system property is empty. When the property is set, the plugin passes a null configuration to LoginContext, so JAAS uses whatever login modules the JVM-wide configuration lists for that entry, without checking them:

// In-memory login configuration. Used only if system property 'java.security.auth.login.config' is not set.
String loginConfigFile = System.getProperty("java.security.auth.login.config");
Configuration loginConfig = null;
if (StringUtils.isNullOrEmpty(loginConfigFile)) {
    // ... in-memory configuration with Krb5LoginModule only ...
}

// Login into Kerberos service and obtain the user subject/credentials.
LoginContext loginContext;
try {
    loginContext = new LoginContext(LOGIN_CONFIG_ENTRY, null, this.credentialsCallbackHandler, loginConfig);
    loginContext.login();

JAAS instantiates every login module class named for the entry and calls it with the driver's credentials callback handler, which supplies the connection's user name (or Kerberos principal) and password. A configuration that names a module other than Krb5LoginModule therefore runs that class inside the application during authentication and hands it the database credentials. The same unchecked code path is present in the 8.0.33 release of MySQL Connector/J, the base of the NES 8.0 line.

Mitigation

MySQL Connector/J is maintained by Oracle, which ships fixes only in the current Connector/J release line; older lines no longer receive updates. For more information, see the MySQL Product Support EOL Announcements.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of MySQL Connector/J.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.