Medium [CVE-2026-55857] Information Disclosure via Insecure PAM Dialog Authentication
This medium-severity Red Hat Linux advisory covers CVE-2026-55857 affecting OpenShift Pipelines, Red Hat build of Debezium 3, Red Hat Build of Keycloak.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection.
The mysql_clear_password plugin is gated behind a secure transport, but the sibling PAM handler SendPamAuthPacketFactory, named dialog by the server, does not declare that requirement and inherits the default secure-required value false; older branches implement the same affected behavior in SendPamAuthPacket.
A hostile or man-in-the-middle server can send an Authentication Switch Request for dialog over plain TCP, causing the driver to return the user's password in cleartext when sslMode=DISABLE and restrictedAuth=null, which is the default configuration. Properly verified TLS and local Unix sockets are not exposed to this transport vector.
This issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9. A remote attacker or a man-in-the-middle server can exploit a vulnerability in the PAM dialog authentication mechanism.
This flaw allows the attacker to coerce the connector into transmitting account passwords over an insecure connection when default configurations are used. Consequently, the user's password can be intercepted in cleartext, leading to sensitive information disclosure.
- < 2.7.14
- < 3.3.5
- < 3.4.3
- < 3.5.9
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
- 2.7.14
- 3.3.5
- 3.4.3
- 3.5.9
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Connect using sslMode=verify-full (or verify-ca) with a properly configured server certificate and trust store, or use a local Unix socket, so the connector never negotiates PAM dialog authentication over cleartext. Setting restrictedAuth to exclude the dialog/mysql_clear_password plugins also prevents disclosure. A fixed MariaDB Connector/J (2.7.14, 3.3.5, 3.4.3, or 3.5.9, as appropriate for the branch in use) additionally addresses the issue.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.