CVE-2026-55860 org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
A man-in-the-middle attacker can steal cleartext passwords from MariaDB Connector/R2DBC clients over unencrypted connections, leading to credential theft and database access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55860?
CVE-2026-55860 is a medium-severity vulnerability in mariadb-corporation mariadb-connector-r2dbc, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.
Which versions are affected by CVE-2026-55860?
2 open source packages ship an affected version, including org.mariadb:r2dbc-mariadb.
| Package | Affected | Fixed in |
|---|---|---|
org.mariadb:r2dbc-mariadb Maven | All versions | 1.4.1 |
org.mariadb:r2dbc-mariadb Maven | All versions | 1.4.1 |
How do I fix CVE-2026-55860?
Upgrade org.mariadb:r2dbc-mariadb to 1.4.1 or later.
Is CVE-2026-55860 being exploited?
There is no known exploitation of CVE-2026-55860 in the wild and no public exploit code.
Sources
Also known as GHSA-c857-9x2m-cvh2.