{"action":"Upgrade org.mariadb:r2dbc-mariadb to 1.4.1 or later.","affected":[{"fixed":"1.4.1","introduced":"0"}],"component":"org.mariadb:r2dbc-mariadb","cve_ids":["CVE-2026-55860"],"ecosystem":"Maven","epss":0.00228,"exploited":false,"fixed_versions":["1.4.1"],"ghsa_id":"GHSA-c857-9x2m-cvh2","id":"tcs_01M5N8RWYHN61D1815ZVK05ZB5","modified_at":"2026-08-28T23:10:37.529702Z","published_at":"2026-08-28T22:50:56Z","references":["https://osv.dev/vulnerability/GHSA-c857-9x2m-cvh2","https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisories/GHSA-c857-9x2m-cvh2","https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603ec5530414996d2396157013e095b320a","https://hackerone.com/reports/3784556","https://github.com/mariadb-corporation/mariadb-connector-r2dbc","https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4.1","https://jira.mariadb.org/browse/R2DBC-115"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-c857-9x2m-cvh2","url":"https://osv.dev/vulnerability/GHSA-c857-9x2m-cvh2"}],"summary":"org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)"}