{"id":"GHSA-473q-m89c-ghf8","kind":"vulnerability","aliases":["GHSA-473q-m89c-ghf8"],"related":[],"title":"MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)","description":"## Summary\n\nWith `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).\n\n## Impact\n\nAn attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:\n\n- uses `SslMode = VerifyCA` or `VerifyFull`, and\n- does not use the `SslCa` connection string option, and\n- uses a non-empty password.\n\nThe attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. \n\nNot affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server).\n\n## Workarounds\n\nProvide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication.\n\n## References\n\n- https://mariadb.org/mission-impossible-zero-configuration-ssl/","summary":"With SslMode VerifyCA or VerifyFull and no SslCa set, MySqlConnector can send the database password in clear text before checking the server certificate. A man-in-the-middle presenting any self-signed certificate can capture that password.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MySqlConnector","fixed":["2.6.1"],"affected":"< 2.6.1","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["cwe-200","dotnet","mariadb","mysql","nuget","package"],"not_affected_if":["ca-configured","empty-password","local-connection","preferred-or-required-ssl"],"how_to_check":"- Search connection strings and config for `SslMode=VerifyCA` or `SslMode=VerifyFull` without `SslCa`\n- Check the installed package version with `dotnet list package` and look for MySqlConnector below `2.6.1`","fix":"- Upgrade MySqlConnector to `2.6.1` or later\n- Or set `SslCa` to a trusted CA certificate alongside `VerifyCA`/`VerifyFull`\n- Or avoid clear-text authentication schemes such as `mysql_clear_password`","status":"open","published_at":"2026-10-28T19:49:44+00:00","first_seen_at":"2026-10-28T19:51:20+00:00","triaged_at":"2026-10-28T19:52:20+00:00","updated_at":"2026-10-28T19:52:20+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-28T19:52:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MySqlConnector to `2.6.1` or later\n- Or set `SslCa` to a trusted CA certificate alongside `VerifyCA`/`VerifyFull`\n- Or avoid clear-text authentication schemes such as `mysql_clear_password`","reach":"network","title":"MySqlConnector: password sent in clear before TLS certificate is verified","impact":"medium","summary":"With SslMode VerifyCA or VerifyFull and no SslCa set, MySqlConnector can send the database password in clear text before checking the server certificate. A man-in-the-middle presenting any self-signed certificate can capture that password.","category":"package","nicknames":[],"who_cares":["dotnet","mysql","mariadb","nuget"],"confidence":0.85,"needs_auth":"no","worst_case":"Database password captured by a network man-in-the-middle","analyst_note":"","how_to_check":"- Search connection strings and config for `SslMode=VerifyCA` or `SslMode=VerifyFull` without `SslCa`\n- Check the installed package version with `dotnet list package` and look for MySqlConnector below `2.6.1`","needs_analyst":false,"not_affected_if":["ca-configured","local-connection","preferred-or-required-ssl","empty-password"],"who_is_affected":"Applications using the MySqlConnector .NET driver with SslMode VerifyCA or VerifyFull, no SslCa option, and a non-empty password, connecting over the network. The MariaDB zero-configuration TLS setup is the typical case where self-signed certificates are used. Connections over Unix sockets or loopback, configured CA setups, Preferred or Required modes, and empty passwords are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":3854,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-200':39B '/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).':143C '/mission-impossible-zero-configuration-ssl/':308C '473q':29A,34A 'account':2A 'affect':253C 'attack':146C,196C 'authent':211C,286C,304C 'avoid':300C 'ca':95C,256C,259C 'ca-valid':258C 'cach':219C 'captur':81B,165C 'cert':133C,204C 'certif':24A,67B,79B,96C,116C,163C 'check':64B,118C,235C 'clear':19A,61B,108C,208C,214C,225C,302C 'clear-text':18A,107C,207C,224C,301C 'client':172C 'complet':197C 'configur':15A,94C,139C,255C 'connect':100C,185C,238C,263C,298C 'cwe':38B 'databas':58B,168C 'defeat':239C 'deploy':149C 'disclos':4A 'document':283C 'dotnet':40B 'e.g':134C 'empti':193C,268C 'expect':249C 'fallback':227C 'fingerprint':234C 'forc':217C 'ghf8':31A,36A 'ghsa':28A,33A 'ghsa-473q-m89c-ghf8':27A,32A 'handshak':200C 'impact':144C 'local':262C 'local/unix-socket':297C 'loopback':266C 'm89c':30A,35A 'man':8A,70B,152C,242C 'man-in-the-middl':7A,69B,151C,241C 'mariadb':41B,135C 'mariadb.com':142C 'mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).':141C 'mariadb.org':307C 'mariadb.org/mission-impossible-zero-configuration-ssl/':306C 'middl':11A,73B,155C,245C 'mode':17A 'mysql':42B,156C,213C 'mysqlconnector':1A,37A,54B 'non':192C 'non-empti':191C 'nuget':43B 'occur':121C 'option':187C 'packag':44B 'password':3A,21A,59B,83B,110C,126C,169C,194C,210C,215C,221C,223C,231C,269C 'plaintext':167C 'prefer':274C 'present':74B,158C 'protect':246C 'provid':251C,290C 'proxi':157C 'receiv':229C 'refer':305C 'reject':236C 'reli':123C 'request':205C 'requir':276C 'scheme':212C 'scope':280C 'secur':104C 'self':77B,131C,161C 'self-sign':76B,130C,160C 'send':56B 'sent':22A,113C 'server':66B,288C 'set':53B,87C,272C 'sha2':220C 'sha256':222C 'sign':78B,132C,162C 'socket':265C 'sslca':52B,184C,257C,291C 'sslmode':46B,86C,175C,271C 'string':186C 'summari':84C 'text':20A,62B,109C,209C,226C,303C 'tls':16A,99C,140C,199C,261C 'treat':102C 'unix':264C 'unvalid':98C 'use':174C,182C,189C,270C,295C 'valid':128C,260C 'verifi':26A 'verifyca':47B,89C,176C,293C 'verifyful':49B,91C,178C,247C,294C 'workaround':289C 'zero':14A,138C 'zero-configur':13A,137C","nicknames":[],"mitigations":[],"who_affected":"Applications using the MySqlConnector .NET driver with SslMode VerifyCA or VerifyFull, no SslCa option, and a non-empty password, connecting over the network. The MariaDB zero-configuration TLS setup is the typical case where self-signed certificates are used. Connections over Unix sockets or loopback, configured CA setups, Preferred or Required modes, and empty passwords are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:49:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-473q-m89c-ghf8","url":"https://github.com/advisories/GHSA-473q-m89c-ghf8","severity":"medium","published_at":"2026-10-28T19:49:44+00:00","modified_at":"2026-10-28T19:49:45+00:00","first_seen_at":"2026-10-28T19:51:20+00:00","fetched_at":"2026-10-28T19:51:20+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}