Skip to content
OpenAdvisories
Medium WID-SEC-2026-3089 7 CVEs

MariaDB Connectors: Mehrere Schwachstellen

Published Aug 30, 2026 · Updated Oct 15, 2026 · Revision 2 · de-DE

Vendor: MariaDB Vendor: Red Hat Product: Enterprise Linux Product: MariaDB Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MariaDB Connectors ausnutzen, um SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten offenzulegen oder zu manipulieren.

Product

MariaDB ist ein relationales Datenbanksystem, das anwendungskompatibel mit MySQL ist.

Vulnerabilities 7

  • Medium 6.5
    CVE-2026-55855

    MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped clie…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • Medium 5.9
    CVE-2026-55854

    MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb

    MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated ove…

    MariaDB mariadb-connector-nodejs sqlpad mariadb Wolfi npm
  • Medium 5.9
    CVE-2026-55856

    MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not c…

    MariaDB mariadb-connector-j keycloak-26.5 keycloak-26.5-iamguarded-compat Wolfi Maven
  • Medium 5.9
    CVE-2026-55857

    MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The my…

    MariaDB mariadb-connector-j keycloak-26.5 keycloak-26.5-iamguarded-compat Wolfi Maven
  • Medium 5.9
    CVE-2026-55858

    MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client

    MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the con…

    MariaDB mariadb-connector-j keycloak-26.5 keycloak-26.5-iamguarded-compat Wolfi Maven
  • Medium 5.9
    CVE-2026-55859

    MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb

    MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a m…

    MariaDB org.mariadb mariadb-connector-r2dbc r2dbc-mariadb Maven
  • Medium 5.9
    CVE-2026-55860

    MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

    MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has n…

    MariaDB org.mariadb mariadb-connector-r2dbc r2dbc-mariadb Maven

Revision history

  1. #2

    Neue Updates von Red Hat aufgenommen

  2. #1

    Initiale Fassung

References