CVE-2026-107819: server >= 3.4.1, < 3.4.10

Affected technology

server · >= 3.4.1, < 3.4.10
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Vendor/CNA’s CVSS 3.1 assessment (base score 5.9/10) rates confidentiality impact as high; integrity and availability impact as none.