GHSA-3f6p-5ww8-9rcr

Suggest an improvement
Source
https://github.com/advisories/GHSA-3f6p-5ww8-9rcr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-3f6p-5ww8-9rcr/GHSA-3f6p-5ww8-9rcr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3f6p-5ww8-9rcr
Downstream
CGA (6)
MINI (3)
ROOT (1)
Published
2026-09-01T16:40:34Z
Modified
2026-09-10T03:51:14Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
Details

Summary

A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

Details

mysql_clear_password is registered as a default standard plugin in lib/commands/auth_switch.js (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting mysql_clear_password, the driver executes it without checking for TLS. The plugin (lib/auth_plugins/mysql_clear_password.js) returns Buffer.from(password + '\0').

Note: caching_sha2_password plugin DOES check for SSL before sending cleartext (line 77). But mysql_clear_password has no such guard.

Attack Scenario

  1. Attacker operates rogue MySQL server or performs MITM
  2. Server advertises caching_sha2_password in handshake
  3. Client sends hashed auth response
  4. Server replies with AuthSwitchRequest to mysql_clear_password
  5. Client sends password in plaintext
  6. Attacker captures plaintext password

PoC

Rogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.

Suggested Fix

Remove mysql_clear_password from standardAuthPlugins, or add a guard requiring TLS/unix socket before allowing cleartext auth.

Impact

  • mysql2: 9M weekly downloads
  • Any application connecting without TLS is vulnerable to credential theft
  • Cloud environments with untrusted network paths are especially at risk
Database specific 
{
    "cwe_ids":  [
        "CWE-522"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-01T16:40:34Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / mysql2

Package

Name
mysql2
View open source insights on deps.dev
Purl
pkg:npm/mysql2

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.22.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-3f6p-5ww8-9rcr/GHSA-3f6p-5ww8-9rcr.json"