All vulnerabilities
GHSA-473q-m89c-ghf8

MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

MySqlConnectornugetLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.6.1Fixed versionGitHub
Published28 Oct 2026Updated 28 Oct 2026GitHub

What fixes it

  • 2.6.1MySqlConnector, nugetGitHubdotnet add package MySqlConnector --version 2.6.1
  • 2.6.1MySqlConnector, NuGetOSVdotnet add package MySqlConnector --version 2.6.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

With SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's zero-configuration TLS.

Impact

An attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:

  • uses SslMode = VerifyCA or VerifyFull, and
  • does not use the SslCa connection string option, and
  • uses a non-empty password.

The attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (mysql_clear_password, or forces the caching_sha2_password/sha256_password clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection VerifyFull is expected to provide.

Not affected: a configured CA (SslCa), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using SslMode set to Preferred or Required is out of scope (this is documented as not authenticating the server).

Workarounds

Provide SslCa with VerifyCA/VerifyFull, use a local/Unix-socket connection, or avoid clear-text authentication.

References

  • https://mariadb.org/mission-impossible-zero-configuration-ssl/

Text from GitHub Advisory Database

Affected versions 52

  • MySqlConnector, nuget< 2.6.1GitHub
  • MySqlConnector, NuGetfrom first release, fixed in 2.6.1OSV
  • MySqlConnector, NuGet0.1.0OSV
  • MySqlConnector, NuGet0.1.0-alpha01OSV
  • MySqlConnector, NuGet0.1.0-alpha02OSV
  • MySqlConnector, NuGet0.1.0-alpha03OSV
  • MySqlConnector, NuGet0.1.0-alpha04OSV
  • MySqlConnector, NuGet0.1.0-alpha05OSV
  • MySqlConnector, NuGet0.1.0-alpha06OSV
  • MySqlConnector, NuGet0.1.0-alpha07OSV
  • MySqlConnector, NuGet0.1.0-alpha08OSV
  • MySqlConnector, NuGet0.1.0-alpha09OSV
  • MySqlConnector, NuGet0.1.0-alpha10OSV
  • MySqlConnector, NuGet0.1.0-alpha11OSV
  • MySqlConnector, NuGet0.1.0-alpha12OSV
  • MySqlConnector, NuGet0.1.0-alpha13OSV
  • MySqlConnector, NuGet0.1.0-alpha14OSV
  • MySqlConnector, NuGet0.1.0-alpha15OSV
  • MySqlConnector, NuGet0.1.0-alpha16OSV
  • MySqlConnector, NuGet0.1.0-alpha17OSV
  • MySqlConnector, NuGet0.1.0-alpha18OSV
  • MySqlConnector, NuGet0.1.0-alpha19OSV
  • MySqlConnector, NuGet0.1.0-alpha20OSV
  • MySqlConnector, NuGet0.1.0-alpha21OSV
  • MySqlConnector, NuGet0.1.0-alpha22OSV
  • MySqlConnector, NuGet0.1.0-alpha23OSV
  • MySqlConnector, NuGet0.1.0-alpha24OSV
  • MySqlConnector, NuGet0.1.0-alpha25OSV
  • MySqlConnector, NuGet0.1.0-alpha26OSV
  • MySqlConnector, NuGet0.10.0OSV
  • MySqlConnector, NuGet0.11.0OSV
  • MySqlConnector, NuGet0.11.1OSV
  • MySqlConnector, NuGet0.11.2OSV
  • MySqlConnector, NuGet0.11.3OSV
  • MySqlConnector, NuGet0.11.4OSV
  • MySqlConnector, NuGet0.11.5OSV
  • MySqlConnector, NuGet0.11.6OSV
  • MySqlConnector, NuGet0.12.0OSV
  • MySqlConnector, NuGet0.13.0OSV
  • MySqlConnector, NuGet0.14.0OSV
  • MySqlConnector, NuGet0.14.1OSV
  • MySqlConnector, NuGet0.15.0OSV
  • MySqlConnector, NuGet0.15.1OSV
  • MySqlConnector, NuGet0.16.0OSV
  • MySqlConnector, NuGet0.16.1OSV
  • MySqlConnector, NuGet0.16.2OSV
  • MySqlConnector, NuGet0.17.0OSV
  • MySqlConnector, NuGet0.18.0OSV
  • MySqlConnector, NuGet0.18.1OSV
  • MySqlConnector, NuGet0.18.2OSV
  • MySqlConnector, NuGet0.18.3OSV
  • MySqlConnector, NuGet0.19.0OSV

References 4