CVE-2026-55860

Overview

MariaDB Connector/R2DBC is MariaDB's non-blocking client for MariaDB and MySQL databases, written in 100% Java. It implements the Reactive Relational Database Connectivity (R2DBC) API, so reactive applications, including those built on Spring Data R2DBC, can connect to and query MariaDB without blocking threads. It is distributed as the Maven artifact org.mariadb:r2dbc-mariadb.

An information exposure vulnerability (CVE-2026-55860) has been identified in the authentication handshake of MariaDB Connector/R2DBC, which allows a hostile or man-in-the-middle server to obtain the database user's password in cleartext over an unencrypted connection. The disclosed credentials can then be used to authenticate directly against the database server.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of MariaDB Connector/R2DBC.

Details

Module Info

• Product: MariaDB Connector/R2DBC
• Affected packages: org.mariadb:r2dbc-mariadb
• Affected versions: <1.2.3, >=1.3.0 <1.3.1, >=1.4.0 <1.4.1
• GitHub repository: https://github.com/mariadb-corporation/mariadb-connector-r2dbc
• Published packages: https://central.sonatype.com/artifact/org.mariadb/r2dbc-mariadb
• Package manager: Maven
• Fixed in:
  • OSS MariaDB Connector/R2DBC 1.2.3, 1.3.1, 1.4.1
  • NES for MariaDB Connector/R2DBC v1.1.4

Vulnerability Info

This Medium-severity vulnerability is found in the org.mariadb:r2dbc-mariadb package in MariaDB Connector/R2DBC before 1.2.3, 1.3.x before 1.3.1 and 1.4.x before 1.4.1.

During the connection handshake the server chooses the authentication plugin, either in its initial handshake packet or later with an AuthSwitchRequest. The AuthenticationFlow class accepts whatever plugin the server names. When the plugin is allowed by the optional restrictedAuth setting, or when restrictedAuth is not set (the default), it loads the plugin without checking whether the connection is encrypted:

} else if (message instanceof AuthSwitchPacket) {
  flow.authSwitchPacket = ((AuthSwitchPacket) message);
  String plugin = flow.authSwitchPacket.getPlugin();
  if (flow.configuration.getRestrictedAuth() != null
      && !Arrays.stream(flow.configuration.getRestrictedAuth())
          .anyMatch(s -> plugin.equals(s))) {
    sink.error(...);
  } else {
    AuthenticationPlugin authPlugin = AuthenticationFlowPluginLoader.get(plugin);
    flow.authMoreDataPacket = null;
    flow.pluginHandler = authPlugin;
    sink.next(AUTH_SWITCH);
  }
}

The AuthenticationPlugin interface has no way for a plugin to declare that it needs a secure transport. So the clear-text plugins mysql_clear_password (ClearPasswordPluginFlow) and dialog (PamPluginFlow) run on any connection, and both reply with the raw password:

return new ClearPasswordPacket(authSwitch.getSequencer(), configuration.getPassword());

The same applies when the server's initial handshake names mysql_clear_password. HandshakeResponse then writes the password as UTF-8 bytes into the handshake response, with the secure-transport check left as a to-do:

case ClearPasswordPluginFlow.TYPE:
  // TODO check that SSL is enable
  authData =
      (password == null) ? new byte[0] : password.toString().getBytes(StandardCharsets.UTF_8);
  break;

An attacker who controls the server, or who sits on the network path of a connection without TLS, can answer the client's handshake with a request for one of these plugins. The driver then sends the account password in cleartext, even if the account normally uses a hashed challenge-response plugin such as mysql_native_password.

Mitigation

Only recent release series of MariaDB Connector/R2DBC are supported by MariaDB plc. Older release series are End-of-Life and will not receive updates addressing this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of MariaDB Connector/R2DBC that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Yalguun Tumenkhuu (finder)