CVE-2026-107819: MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure
MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysqlclearpassword and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MariaDB Connector/C libmariadbto a version that resolves this vulnerability.Fixed in 3.4.10
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using MariaDB Connector/C libmariadb versions 3.4.1 through 3.4.9 are affected. Other MariaDB connectors are not affected.
What does an attacker need to exploit it?
An attacker must be active on the connection path and able to perform a man-in-the-middle attack using a valid TLS certificate for a different hostname. The attacker can then request the mysql_clear_password authentication plugin and capture the database password within the attacker-controlled TLS connection.
Is a certificate trust failure enough to trigger the issue?
No. The affected logic checked certificate trust failures; the flaw was specifically that it did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin.
What is the available remediation?
Upgrade MariaDB Connector/C to version 3.4.10, which fixes the issue.