high · 7.5CVE-2026-55215Aug 28, 2026

CVE-2026-55215: mariadb (npm) Cleartext Password Leak to MitM via Late SSL Fingerprint Check

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

The MariaDB Node.js connector sends your database password to the network peer before checking whether the server is actually who it claims to be, so anyone in a position to intercept the connection…

Packagemariadb
Ecosystemnpm
Affected< 3.2.4
Fixed in3.2.4
CVE-2026-55215: mariadb (npm) Cleartext Password Leak to MitM via Late SSL Fingerprint Check

The problem

When SSL is enabled but no CA certificate is supplied, the connector falls back to fingerprint-based server identity validation. The problem is sequencing: the connector completes the MariaDB authentication handshake, transmitting the cleartext password, and only then checks the fingerprint.

An active on-path attacker who terminates the TLS session with their own certificate receives the authentication packet containing the plaintext password. The fingerprint check then fails and the connection closes, but the credential has already been disclosed and can be replayed directly against the real server.

Proof of concept

A working proof-of-concept for CVE-2026-55215 in mariadb, with the exact payload below.

javascript
// Attacker intercepts TCP, presents any TLS cert, receives this auth packet:
// (Wireshark decode of MariaDB Handshake Response packet sent by vulnerable connector)

const mariadb = require('mariadb');

// Victim app -- ssl: true with no CA/cert supplied (the vulnerable config)
mariadb.createConnection({
  host: 'db.example.com', // MitM is intercepting this
  user: 'appuser',
  password: 's3cr3tP@ssword',
  ssl: true              // no 'ca', no 'cert' -- fingerprint-only mode
}).catch(() => {});

// The connector upgrades to TLS using the attacker's certificate,
// then sends the HandshakeResponse41 packet (containing the hashed
// or cleartext password depending on auth plugin) BEFORE evaluating
// the fingerprint. Attacker captures the packet and drops the conn.
// Fingerprint check fires too late -- credential already transmitted.

The root cause is a logic-ordering bug (CWE-295 / CWE-522). The connector performs the full MariaDB protocol handshake, including authentication, inside the TLS session established with the attacker-controlled certificate, and defers fingerprint validation to a post-auth callback.

The patch (commit 514576a) moves the fingerprint check to fire before the authentication step is allowed to proceed, so the connection is aborted before any credential material is written to the socket. A secondary fix switches the fingerprint comparison to a constant-time function, closing a timing side-channel (CONJS-351) that could have leaked the token independently.

The fix

Upgrade to mariadb npm package 3.2.4, 3.3.3, 3.4.6, or 3.5.3 (matching your current minor branch). If you cannot upgrade immediately, supply an explicit CA certificate and set ssl mode to VERIFY_CA or VERIFY_FULL so the server identity is confirmed at the TLS layer before any data flows.

Reported by haaahaaahiihiiii.

References: [1][2][3][4][5][6]

Related research