MariaDB Connector/R2DBC allows cleartext password disclosure without requiring a secure transport. Prior to version 1.4.1, clear‑text authentication plugins such as mysql_clear_password and dialog (PAM) can be invoked over plain TCP, causing the client to transmit the user’s password as raw bytes. Attackers who can intercept or control the server can then capture these credentials and use them to authenticate to the database directly, potentially gaining unauthorized access. The flaw is classified as CWE‑319 (Cleartext Transmission of Sensitive Information) and CWE‑522 (Insufficiently Protected Credentials).

Affected products include MariaDB Connector/R2DBC libraries from MariaDB Corporation (mariadb-connector-r2dbc) and the community artifact org.mariadb:r2dbc-mariadb. The vulnerability is present in all releases before 1.4.1; upgrading to 1.4.1 or later eliminates the issue.

The vulnerability carries a CVSS score of 5.9, indicating moderate severity. EPSS data is not available, so the current exploitation probability cannot be quantified. The flaw is not listed in CISA’s KEV catalog. The most likely attack vector involves a man‑in‑the‑middle or hostile MariaDB server that sends an AuthSwitchRequest to trigger the clear‑text authentication plugin over an unencrypted channel. Exploitation requires that the client connects via plain TCP to the database; if transports are encrypted, the flaw cannot be leveraged.