CVE-2026-55860 is a medium-severity (CVSS 5.9) CWE-319 vulnerability in org.mariadb:r2dbc-mariadb. O3 Security confirms whether CVE-2026-55860 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Real-World Exposure
org.mariadb:r2dbc-mariadbReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The connector does not gate clear-text password authentication plugins on transport encryption. A hostile or man-in-the-middle MariaDB server can request a clear-text plugin over an unencrypted (plain-TCP) connection, and the driver responds with the user's password in cleartext on the wire.
Details
The driver does not require a secure transport before using clear-text-password authentication plugins. A hostile or man-in-the-middle server can issue an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP, unencrypted connection, and the driver replies with the user's password as cleartext bytes on the wire.
The root cause is that the AuthenticationPlugin interface declares no capability for a plugin to require a secure connection. Because no such gate exists, clear-text plugins run regardless of whether the connection is encrypted.
Impact
The account password is transmitted in cleartext to the peer. An on-path attacker (MITM) who presents themselves as the server can capture the password during the authentication handshake. The disclosed credentials can subsequently be used to authenticate directly against the database server.
Patches
Fixed in 1.4.1. Clear-text authentication plugins (mysql_clear_password, dialog/PAM) now require a secure connection: the AuthenticationPlugin contract can declare that a plugin requires a secure transport, and such plugins are permitted only over an encrypted connection. Upgrade to 1.4.1 or later.
Workarounds
Until you can upgrade, configure certificate verification explicitly: provide the server/CA certificate and use a verifying SSL mode (e.g. VERIFY_CA / VERIFY_FULL) so the connection is encrypted and the server's identity is established before credentials are sent.
Credit
Reported by Yalguun Tumenkhuu (@fg0x0).
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.mariadb:r2dbc-mariadb | all versions | 1.4.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.mariadb:r2dbc-mariadb. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update org.mariadb:r2dbc-mariadb to 1.4.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-55860 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-55860 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-55860. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-55860 in your dependencies?
O3 detects CVE-2026-55860 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.