PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107819 MariaDB CVE debrief

CVE-2026-107819 MariaDB Connector/C libmariadb allowed cleartext password leakage on TLS hostname verification failure. The CVE record was published on 2026-10-09T17:25:45.082Z and has not been modified since then. This vulnerability affects MariaDB Connector/C versions 3.4.1 to 3.4.9, allowing an active man-in-the-middle attacker with a valid certificate for another hostname to request mysql_clear_password and obtain the database password. The issue is fixed in version 3.4.10. Defenders should assess exposure and prioritize upgrading to version 3.4.10.

Vendor
MariaDB
Product
server
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-09
Original CVE updated
2026-10-09
Advisory published
2026-10-09
Advisory updated
2026-10-09

Who should care

Defenders responsible for MariaDB Connector/C deployments, particularly those using versions between 3.4.1 and 3.4.10, should assess exposure and prioritize upgrading to version 3.4.10.

Why it matters

Defenders should care about CVE-2026-107819 because it allows potential cleartext password leakage in MariaDB Connector/C deployments, particularly those using versions between 3.4.1 and 3.4.10. The vulnerability requires verification of exposure and remediation through upgrading to version 3.4.10.

  • Potential cleartext password leakage
  • Possible man-in-the-middle attacks
  • Need for verification of exposure and remediation
  • Upgrade priority for affected versions

Technical summary

MariaDB Connector/C versions 3.4.1 to 3.4.9 are vulnerable to cleartext password leakage on TLS hostname verification failure. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password. The issue is fixed in version 3.4.10. Other MariaDB connectors are not affected. Defenders should prioritize verifying exposure and upgrading to version 3.4.10 if vulnerable. The vulnerability requires verification of exposure and remediation through upgrading to version 3.4.10.

Defensive priority

Defenders should prioritize verifying exposure of MariaDB Connector/C versions between 3.4.1 and 3.4.10, and upgrading to version 3.4.10 if vulnerable.

Recommended defensive actions

  • Verify exposure of MariaDB Connector/C versions between 3.4.1 and 3.4.9
  • Upgrade to version 3.4.10 if vulnerable
  • Monitor for potential man-in-the-middle attacks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in MariaDB Connector/C, including affected versions and a fixed version. The vulnerability allows potential cleartext password leakage in MariaDB Connector/C deployments, particularly those using versions between 3.4.1 and 3.4.9. Defenders should verify exposure and consider upgrading to version 3.4.10. The source item provides additional context on the vulnerability, but its details are limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107819 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107819

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107819 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107819

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107819.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://jira.mariadb.org/browse/CONC-846

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.