CVE-2026-55856 mariadb-corporation CVE debrief

Who should care

Defenders responsible for Java applications using MariaDB Connector/J, particularly those in roles related to database security, vulnerability management, and incident response, should assess exposure and prioritize remediation.

Why it matters

A vulnerability in MariaDB Connector/J allows an active man-in-the-middle or hostile server to present a self-signed certificate and receive the full database password before the connection is rejected. Defenders should prioritize verifying exposure and assessing the impact on their systems, particularly those using MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

• An active man-in-the-middle or hostile server can receive the full database password before the connection is rejected.
• Defenders must verify exposure and assess the impact on their systems.
• Remediation requires upgrading to versions 2.7.14, 3.3.5, 3.4.3, or 3.5.9 or later.
• The vulnerability requires verification of serverSslCert or trustStore configuration.

Technical summary

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept an untrusted self-signed certificate through the fallbackToSystemTrustStore=true ephemeral trust manager and record its certFingerprint for later identity binding.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly those using MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

Recommended defensive actions

• Verify the version of MariaDB Connector/J being used and assess exposure
• Upgrade to versions 2.7.14, 3.3.5, 3.4.3, or 3.5.9 or later
• Configure serverSslCert or trustStore to prevent fallback to system trust store
• Monitor for suspicious activity and implement compensating controls
• Perform thorough vulnerability scanning to identify potentially exposed systems
• Review and update incident response plans to address potential impacts
• Implement additional logging and monitoring to detect unusual activity

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and the fixed versions. However, the corpus does not establish versions, exploitation, impact, or remediation for all affected systems, requiring verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.