---
id: CVE-2026-55860
title: >-
  MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented
  in Java
summary: >-
  MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented
  in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text
  password authentication plugins on transport encryption because the
  Authentication…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-319
  - CWE-522
vendor: mariadb
product: 'org.mariadb:r2dbc-mariadb'
affected:
  - 'org.mariadb:r2dbc-mariadb < 1.4.1'
patched:
  - 'org.mariadb:r2dbc-mariadb 1.4.1'
published: '2026-08-28'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:08:37.320'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55860'
references:
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a
    label: security-advisories@github.com
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1
    label: security-advisories@github.com
  - url: >-
      https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-c857-9x2m-cvh2
    label: security-advisories@github.com
  - url: 'https://hackerone.com/reports/3784556'
    label: security-advisories@github.com
  - url: 'https://jira.mariadb.org/browse/R2DBC-115'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-c857-9x2m-cvh2'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00152
epssPercentile: 0.04692
aliases:
  - GHSA-c857-9x2m-cvh2
ecosystem: maven
ingestedAt: '2026-08-28T23:26:57.273Z'
---

## Overview

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire. The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55860)

Affected packages:

- `org.mariadb:r2dbc-mariadb < 1.4.1`

Patched in:

- `org.mariadb:r2dbc-mariadb 1.4.1`

Source: https://github.com/advisories/GHSA-c857-9x2m-cvh2