---
id: "GHSA-473q-m89c-ghf8"
kind: "vulnerability"
aliases: ["GHSA-473q-m89c-ghf8"]
title: "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "MySqlConnector", "fixed": ["2.6.1"], "affected": "< 2.6.1", "ecosystem": "nuget"}]
ecosystems: ["nuget"]
tags: ["cwe-200", "dotnet", "mariadb", "mysql", "nuget", "package"]
not_affected_if: ["ca-configured", "empty-password", "local-connection", "preferred-or-required-ssl"]
published_at: "2026-10-28T19:49:44+00:00"
first_seen_at: "2026-10-28T19:51:20+00:00"
updated_at: "2026-10-28T19:52:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-473q-m89c-ghf8", "first_seen_at": "2026-10-28T19:51:20+00:00"}]
---

# MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

With SslMode VerifyCA or VerifyFull and no SslCa set, MySqlConnector can send the database password in clear text before checking the server certificate. A man-in-the-middle presenting any self-signed certificate can capture that password.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:MySqlConnector affected < 2.6.1 fixed 2.6.1

## How to check

- Search connection strings and config for `SslMode=VerifyCA` or `SslMode=VerifyFull` without `SslCa`
- Check the installed package version with `dotnet list package` and look for MySqlConnector below `2.6.1`

## Fix

- Upgrade MySqlConnector to `2.6.1` or later
- Or set `SslCa` to a trusted CA certificate alongside `VerifyCA`/`VerifyFull`
- Or avoid clear-text authentication schemes such as `mysql_clear_password`

## Timeline

- 2026-10-28T19:51:20+00:00 ghsa https://github.com/advisories/GHSA-473q-m89c-ghf8

## From the sources

## Summary

With `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).

## Impact

An attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:

- uses `SslMode = VerifyCA` or `VerifyFull`, and
- does not use the `SslCa` connection string option, and
- uses a non-empty password.

The attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. 

Not affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server).

## Workarounds

Provide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication.

## References

- https://mariadb.org/mission-impossible-zero-configuration-ssl/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_