MariaDB Node.js Connector Credential Disclosure via MitM

The MariaDB connector for Node.js contains a high-severity vulnerability (CVE-2026-55215) where database credentials are transmitted in cleartext to an untrusted peer during the initial handshake. This occurs when SSL/TLS is enabled but the client is not configured to explicitly verify the server's certificate or CA. Under these conditions, the connector performs authentication before completing the identity validation check. While the connection eventually terminates due to a failed fingerprint validation, the damage occurs during the handshake when an active man-in-the-middle (MitM) attacker can capture the credentials by presenting any certificate to the client. This vulnerability affects multiple versions across the 3.x release branch. Organizations using the affected MariaDB npm package are at risk of credential exposure if network-level attackers can position themselves on the path between the application and the database server.

Impact

Successful exploitation leads to the disclosure of database credentials, allowing an attacker to gain unauthorized access to the backend MariaDB instance. The impact is significant as it provides persistent access to sensitive data stored within the database. The scope includes any application environment using the vulnerable npm package where SSL/TLS is enabled without strict certificate validation (e.g., using default configurations or incomplete SSL settings).

Recommendation

1. Upgrade the MariaDB npm package to the patched versions: 3.2.4, 3.3.3, 3.4.6, or 3.5.3.
2. If patching is not immediately feasible, configure certificate verification explicitly in the connection settings.
3. Ensure the application provides the appropriate CA or server certificate and enforces VERIFY_CA or VERIFY_FULL modes to ensure identity validation occurs before authentication credentials are transmitted.