CVE-2026-55860: MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Vulnerability summary
CVE-2026-55860 is a medium (CVSS 5.9) vulnerability in mariadb-corporation mariadb-connector-r2dbc. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.6% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 28-08-2026PublishedVulnerability first disclosed.
- 31-08-2026Last modifiedVulnerability information updated.
Description
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.23%
Chance of exploitation in the next 30 days
Percentile
14%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.23% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Org.mariadb2 products
- r2dbc-mariadb< 1.4.1
- r2dbc-mariadb< 1.4.1
Mariadb-corporation1 product
- mariadb-connector-r2dbc< 1.4.1
2 vendors · 3 products