{"id":"GHSA-473q-m89c-ghf8","summary":"MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)","details":"## Summary\n\nWith `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).\n\n## Impact\n\nAn attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:\n\n- uses `SslMode = VerifyCA` or `VerifyFull`, and\n- does not use the `SslCa` connection string option, and\n- uses a non-empty password.\n\nThe attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. \n\nNot affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server).\n\n## Workarounds\n\nProvide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication.\n\n## References\n\n- https://mariadb.org/mission-impossible-zero-configuration-ssl/","modified":"2026-10-28T20:00:04.871955012Z","published":"2026-10-28T19:49:44Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-200"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-10-28T19:49:44Z"},"references":[{"type":"WEB","url":"https://github.com/mysql-net/MySqlConnector/security/advisories/GHSA-473q-m89c-ghf8"},{"type":"WEB","url":"https://github.com/mysql-net/MySqlConnector/commit/86503613fe3b72ae26c03dd1ea92f0e1e6e208f9"},{"type":"PACKAGE","url":"https://github.com/mysql-net/MySqlConnector"},{"type":"WEB","url":"https://github.com/mysql-net/MySqlConnector/releases/tag/2.6.1"}],"affected":[{"package":{"name":"MySqlConnector","ecosystem":"NuGet","purl":"pkg:nuget/MySqlConnector"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1"}]}],"versions":["0.1.0","0.1.0-alpha01","0.1.0-alpha02","0.1.0-alpha03","0.1.0-alpha04","0.1.0-alpha05","0.1.0-alpha06","0.1.0-alpha07","0.1.0-alpha08","0.1.0-alpha09","0.1.0-alpha10","0.1.0-alpha11","0.1.0-alpha12","0.1.0-alpha13","0.1.0-alpha14","0.1.0-alpha15","0.1.0-alpha16","0.1.0-alpha17","0.1.0-alpha18","0.1.0-alpha19","0.1.0-alpha20","0.1.0-alpha21","0.1.0-alpha22","0.1.0-alpha23","0.1.0-alpha24","0.1.0-alpha25","0.1.0-alpha26","0.10.0","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.11.6","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.16.1","0.16.2","0.17.0","0.18.0","0.18.1","0.18.2","0.18.3","0.19.0","0.19.1","0.19.2","0.19.3","0.19.4","0.19.5","0.2.0","0.2.1","0.20.0","0.20.1","0.20.2","0.21.0","0.22.0","0.23.0","0.24.0","0.24.1","0.24.2","0.25.0","0.25.1","0.26.0","0.26.1","0.26.2","0.26.3","0.26.4","0.26.5","0.27.0","0.28.0","0.28.2","0.29.0","0.29.1","0.29.2","0.29.3","0.29.4","0.3.0","0.30.0","0.31.0","0.31.1","0.31.2","0.31.3","0.32.0","0.33.0","0.33.1","0.33.2","0.34.0","0.34.1","0.34.2","0.35.0","0.36.0","0.36.1","0.37.0","0.37.1","0.38.0","0.39.0","0.4.0","0.40.0","0.40.1","0.40.2","0.40.3","0.40.4","0.41.0","0.42.0","0.42.1","0.42.2","0.42.3","0.43.0","0.44.0","0.44.1","0.45.0","0.45.1","0.46.0","0.46.1","0.46.2","0.47.0","0.47.1","0.48.0","0.48.0-beta1","0.48.0-beta2","0.48.0-beta3","0.48.0-rc1","0.48.0-rc2","0.48.1","0.48.2","0.49.0","0.49.1","0.49.2","0.49.3","0.5.0","0.50.0","0.51.0","0.51.1","0.52.0","0.53.0","0.54.0","0.55.0","0.56.0","0.57.0","0.57.0-beta10","0.57.0-beta2","0.57.0-beta3","0.57.0-beta4","0.57.0-beta5","0.57.0-beta6","0.57.0-beta7","0.57.0-beta8","0.57.0-beta9","0.57.0-rc1","0.58.0","0.59.0","0.59.1","0.59.2","0.6.0","0.6.1","0.6.2","0.60.0","0.60.0-beta1","0.60.1","0.60.2","0.60.3","0.60.3-beta1","0.60.4","0.61.0","0.62.0","0.62.0-beta1","0.62.0-beta2","0.62.0-beta3","0.62.0-beta4","0.62.0-beta5","0.62.0-beta6","0.62.0-beta7","0.63.0","0.63.1","0.63.2","0.64.0","0.64.1","0.64.2","0.65.0","0.66.0","0.67.0","0.68.0","0.68.1","0.69.0","0.69.1","0.69.10","0.69.2","0.69.3","0.69.4","0.69.5","0.69.6","0.69.7","0.69.8","0.69.9","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.9.0","0.9.1","0.9.2","1.0.0","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.14","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","2.0.0","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.4.0","2.5.0","2.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-473q-m89c-ghf8/GHSA-473q-m89c-ghf8.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}