CVE-2026-55215 affects MariaDB Connector/Node.js versions prior to 3.3.3, 3.4.6, and 3.5.3. When SSL is enabled without a pinned CA or server certificate, the connector sends database credentials before completing TLS certificate fingerprint validation. Two vulnerable code paths exist: one in handshake.js where mysql_clear_password can receive the password before post-TLS identity checks, and another in authentication.js where an authentication plugin switch can cause credentials to be sent prematurely. An active man-in-the-middle attacker can present a self-signed certificate, intercept the plaintext database password, and use it to authenticate directly to the database. The connector eventually rejects the rogue server and closes the connection, but the credential has already been captured. Fixed versions 3.3.3, 3.4.6, and 3.5.3 address both vulnerable code paths.
