CVE-2026-107819: MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not establishedNothing in the sources we check

DescriptionNVD

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Improper Validation of Certificate with Host Mismatch · Cryptography

Vendor

MariaDB

Published

October 2026

Band

Unlikely (under 1%), October 2026

Bounty reports

1 disclosed on HackerOne

• NVD entrynvd.nist.gov
• Vendor advisorygithub.com
• CVE recordcve.org