TI-2026-70109 Aliases CVE-2026-107819

Cleartext password exposure in MariaDB Connector/C on TLS hostname mismatch

LOW 26CWE-297Published 2026-10-09 · Updated 2026-10-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

MariaDB Connector/C from 3.4.1 before 3.4.10 does not reject a TLS hostname verification mismatch before it selects a non-hashing authentication plugin (CWE-297). An active man in the middle attacker with a valid certificate for another hostname can obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00346 28th percentileScored 2026-11-07

Fix Partial server (MariaDB): 3.4.10Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MariaDB	server	3.4.1 to before 3.4.10	3.4.10	Patch available	CNA

server VendorMariaDB Affected 3.4.1 to before 3.4.10 Fixed in 3.4.10 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:mariadb:mariadb::::::::	—	—	MariaDB

cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* Versions — — ·MariaDB

Remediation

Upgrade MariaDB Connector/C to version 3.4.10, which fixes this issue. Red Hat Enterprise Linux 10 is affected, and the sources list no fixed version for it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA server (MariaDB) Fixed in 3.4.10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred

Not affected: 3 products

Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Hardened Images

Timeline

2026-10-10 Threatist record created from CVE-2026-107819
2026-10-10 Affected versions changed · Red Hat
2026-10-10 CVSS score added · Red Hat
2026-10-13 Affected versions changed · Red Hat

References

Other 4

TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5

See all 459 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences