GHSA-473q-m89c-ghf8

Suggest an improvement
Source
https://github.com/advisories/GHSA-473q-m89c-ghf8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-473q-m89c-ghf8/GHSA-473q-m89c-ghf8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-473q-m89c-ghf8
Published
2026-10-28T19:49:44Z
Modified
2026-10-28T20:00:04Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)
Details

Summary

With SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's zero-configuration TLS.

Impact

An attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:

  • uses SslMode = VerifyCA or VerifyFull, and
  • does not use the SslCa connection string option, and
  • uses a non-empty password.

The attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (mysql_clear_password, or forces the caching_sha2_password/sha256_password clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection VerifyFull is expected to provide.

Not affected: a configured CA (SslCa), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using SslMode set to Preferred or Required is out of scope (this is documented as not authenticating the server).

Workarounds

Provide SslCa with VerifyCA/VerifyFull, use a local/Unix-socket connection, or avoid clear-text authentication.

References

Database specific 
{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-28T19:49:44Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

NuGet / MySqlConnector

Package

Name
MySqlConnector
View open source insights on deps.dev
Purl
pkg:nuget/MySqlConnector

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.1

Affected versions

0.*
0.1.0-alpha01
0.1.0-alpha02
0.1.0-alpha03
0.1.0-alpha04
0.1.0-alpha05
0.1.0-alpha06
0.1.0-alpha07
0.1.0-alpha08
0.1.0-alpha09
0.1.0-alpha10
0.1.0-alpha11
0.1.0-alpha12
0.1.0-alpha13
0.1.0-alpha14
0.1.0-alpha15
0.1.0-alpha16
0.1.0-alpha17
0.1.0-alpha18
0.1.0-alpha19
0.1.0-alpha20
0.1.0-alpha21
0.1.0-alpha22
0.1.0-alpha23
0.1.0-alpha24
0.1.0-alpha25
0.1.0-alpha26
0.1.0
0.2.0
0.2.1
0.3.0
0.4.0
0.5.0
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.8.0
0.9.0
0.9.1
0.9.2
0.10.0
0.11.0
0.11.1
0.11.2
0.11.3
0.11.4
0.11.5
0.11.6
0.12.0
0.13.0
0.14.0
0.14.1
0.15.0
0.15.1
0.16.0
0.16.1
0.16.2
0.17.0
0.18.0
0.18.1
0.18.2
0.18.3
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.20.0
0.20.1
0.20.2
0.21.0
0.22.0
0.23.0
0.24.0
0.24.1
0.24.2
0.25.0
0.25.1
0.26.0
0.26.1
0.26.2
0.26.3
0.26.4
0.26.5
0.27.0
0.28.0
0.28.2
0.29.0
0.29.1
0.29.2
0.29.3
0.29.4
0.30.0
0.31.0
0.31.1
0.31.2
0.31.3
0.32.0
0.33.0
0.33.1
0.33.2
0.34.0
0.34.1
0.34.2
0.35.0
0.36.0
0.36.1
0.37.0
0.37.1
0.38.0
0.39.0
0.40.0
0.40.1
0.40.2
0.40.3
0.40.4
0.41.0
0.42.0
0.42.1
0.42.2
0.42.3
0.43.0
0.44.0
0.44.1
0.45.0
0.45.1
0.46.0
0.46.1
0.46.2
0.47.0
0.47.1
0.48.0-beta1
0.48.0-beta2
0.48.0-beta3
0.48.0-rc1
0.48.0-rc2
0.48.0
0.48.1
0.48.2
0.49.0
0.49.1
0.49.2
0.49.3
0.50.0
0.51.0
0.51.1
0.52.0
0.53.0
0.54.0
0.55.0
0.56.0
0.57.0-beta10
0.57.0-beta2
0.57.0-beta3
0.57.0-beta4
0.57.0-beta5
0.57.0-beta6
0.57.0-beta7
0.57.0-beta8
0.57.0-beta9
0.57.0-rc1
0.57.0
0.58.0
0.59.0
0.59.1
0.59.2
0.60.0-beta1
0.60.0
0.60.1
0.60.2
0.60.3-beta1
0.60.3
0.60.4
0.61.0
0.62.0-beta1
0.62.0-beta2
0.62.0-beta3
0.62.0-beta4
0.62.0-beta5
0.62.0-beta6
0.62.0-beta7
0.62.0
0.63.0
0.63.1
0.63.2
0.64.0
0.64.1
0.64.2
0.65.0
0.66.0
0.67.0
0.68.0
0.68.1
0.69.0
0.69.1
0.69.2
0.69.3
0.69.4
0.69.5
0.69.6
0.69.7
0.69.8
0.69.9
0.69.10
1.*
1.0.0
1.0.1
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
2.*
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.1.10
2.1.11
2.1.12
2.1.13
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.4.0
2.5.0
2.6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-473q-m89c-ghf8/GHSA-473q-m89c-ghf8.json"