Description

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as the initial authentication plugin can receive the password before the post-TLS identity check. In lib/cmd/handshake/authentication.js, an authentication switch can evaluate the previous plugin instead of the requested target plugin, allowing mysql_clear_password to send the credential first. An active man-in-the-middle can present a self-signed certificate, capture the database password, and use it to authenticate directly even though the connector later rejects the server and closes the connection. This issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T20:18:26.353Z",
  "pubdate": "2026-08-28T20:18:26.353Z",
  "executiveSummary": "The MariaDB Connector/Node.js is susceptible to a critical credential disclosure vulnerability occurring during the TLS handshake process.\nThe vulnerability allows an active man-in-the-middle (MitM) attacker to intercept database credentials by exploiting improper sequence of certificate validation and authentication plugin execution.\nAffected products include MariaDB Connector/Node.js versions prior to 3.3.3, 3.4.6, and 3.5.3.\nWhen SSL is enabled without explicit CA or server certificate pinning, the connector prematurely transmits credentials before the post-TLS identity verification is completed.\nAn attacker positioned on the network path can present a self-signed certificate, force the usage of the mysql_clear_password plugin, and capture the database password.\nEven though the connector eventually detects the certificate mismatch and terminates the connection, the credentials have already been exfiltrated to the malicious intermediary.\nThis vulnerability poses a significant risk to data confidentiality, as compromised credentials may allow unauthorized direct access to the backend database infrastructure, bypassing the intended security controls of the Node.js application layer.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper ordering of operations within the handshake process implemented in MariaDB Connector/Node.js. Specifically, the library fails to enforce a strict temporal sequence where certificate verification must be successfully completed before any authentication data, such as credentials, is transmitted to the server.\nThe vulnerability manifests primarily within lib/cmd/handshake/auth/handshake.js and lib/cmd/handshake/authentication.js. In the former, the logic permits the server to request the mysql_clear_password authentication plugin as the initial step. If the connector is configured with SSL enabled but lacks rigid pinning, it proceeds to send credentials immediately upon the server's request, bypassing the subsequent post-TLS identity check.\nIn lib/cmd/handshake/authentication.js, the authentication switch mechanism contains a logic error where it evaluates the state of the previous authentication plugin rather than the requested target plugin. This discrepancy allows the system to erroneously fall back or proceed with the mysql_clear_password flow, effectively prioritizing credential transmission over connection integrity verification.\nThe exploitation flow is as follows: 1) An active MitM attacker intercepts the client-to-server connection attempt. 2) The attacker presents a malicious, self-signed certificate to the connector. 3) Because the connector is not configured with certificate pinning, it enters the handshake process. 4) The attacker's malicious server requests the mysql_clear_password plugin. 5) Due to the identified logic flaw, the connector transmits the database credentials to the attacker before the TLS handshake identity check is finalized. 6) The connector eventually realizes the certificate is untrusted and aborts the connection, but the credential payload has already been transmitted to the attacker's server.\nThis flaw is exploitable via a network-level intercept, requiring the attacker to possess the capability to perform an active MitM attack between the Node.js application and the database server. Once the credentials are exfiltrated, the attacker gains the necessary authentication material to conduct unauthorized database queries or administrative operations directly, rendering the initial TLS protection ineffective for credential security."
}