ghsa-473q-m89c-ghf8
CVSS 6.9 osv_nuget## Summary With `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl). ## Impact An attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that: - uses `SslMode = VerifyCA` or `VerifyFull`, and - does not use the `SslCa` connection string option, and - uses a non-empty password. The attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. Not affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server). ## Workarounds Provide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication. ## References - https://mariadb.org/mission-impossible-zero-configuration-ssl/
- Published
- unknown
- Last Modified
- unknown
CVSS details not available.
No product information available.
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-473q-m89c-ghf8/GHSA-473q-m89c-ghf8.json"
},
"package": {
"ecosystem": "NuGet",
"name": "MySqlConnector",
"purl": "pkg:nuget/MySqlConnector"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.0",
"0.1.0-alpha01",
"0.1.0-alpha02",
"0.1.0-alpha03",
"0.1.0-alpha04",
"0.1.0-alpha05",
"0.1.0-alpha06",
"0.1.0-alpha07",
"0.1.0-alpha08",
"0.1.0-alpha09",
"0.1.0-alpha10",
"0.1.0-alpha11",
"0.1.0-alpha12",
"0.1.0-alpha13",
"0.1.0-alpha14",
"0.1.0-alpha15",
"0.1.0-alpha16",
"0.1.0-alpha17",
"0.1.0-alpha18",
"0.1.0-alpha19",
"0.1.0-alpha20",
"0.1.0-alpha21",
"0.1.0-alpha22",
"0.1.0-alpha23",
"0.1.0-alpha24",
"0.1.0-alpha25",
"0.1.0-alpha26",
"0.10.0",
"0.11.0",
"0.11.1",
"0.11.2",
"0.11.3",
"0.11.4",
"0.11.5",
"0.11.6",
"0.12.0",
"0.13.0",
"0.14.0",
"0.14.1",
"0.15.0",
"0.15.1",
"0.16.0",
"0.16.1",
"0.16.2",
"0.17.0",
"0.18.0",
"0.18.1",
"0.18.2",
"0.18.3",
"0.19.0",
"0.19.1",
"0.19.2",
"0.19.3",
"0.19.4",
"0.19.5",
"0.2.0",
"0.2.1",
"0.20.0",
"0.20.1",
"0.20.2",
"0.21.0",
"0.22.0",
"0.23.0",
"0.24.0",
"0.24.1",
"0.24.2",
"0.25.0",
"0.25.1",
"0.26.0",
"0.26.1",
"0.26.2",
"0.26.3",
"0.26.4",
"0.26.5",
"0.27.0",
"0.28.0",
"0.28.2",
"0.29.0",
"0.29.1",
"0.29.2",
"0.29.3",
"0.29.4",
"0.3.0",
"0.30.0",
"0.31.0",
"0.31.1",
"0.31.2",
"0.31.3",
"0.32.0",
"0.33.0",
"0.33.1",
"0.33.2",
"0.34.0",
"0.34.1",
"0.34.2",
"0.35.0",
"0.36.0",
"0.36.1",
"0.37.0",
"0.37.1",
"0.38.0",
"0.39.0",
"0.4.0",
"0.40.0",
"0.40.1",
"0.40.2",
"0.40.3",
"0.40.4",
"0.41.0",
"0.42.0",
"0.42.1",
"0.42.2",
"0.42.3",
"0.43.0",
"0.44.0",
"0.44.1",
"0.45.0",
"0.45.1",
"0.46.0",
"0.46.1",
"0.46.2",
"0.47.0",
"0.47.1",
"0.48.0",
"0.48.0-beta1",
"0.48.0-beta2",
"0.48.0-beta3",
"0.48.0-rc1",
"0.48.0-rc2",
"0.48.1",
"0.48.2",
"0.49.0",
"0.49.1",
"0.49.2",
"0.49.3",
"0.5.0",
"0.50.0",
"0.51.0",
"0.51.1",
"0.52.0",
"0.53.0",
"0.54.0",
"0.55.0",
"0.56.0",
"0.57.0",
"0.57.0-beta10",
"0.57.0-beta2",
"0.57.0-beta3",
"0.57.0-beta4",
"0.57.0-beta5",
"0.57.0-beta6",
"0.57.0-beta7",
"0.57.0-beta8",
"0.57.0-beta9",
"0.57.0-rc1",
"0.58.0",
"0.59.0",
"0.59.1",
"0.59.2",
"0.6.0",
"0.6.1",
"0.6.2",
"0.60.0",
"0.60.0-beta1",
"0.60.1",
"0.60.2",
"0.60.3",
"0.60.3-beta1",
"0.60.4",
"0.61.0",
"0.62.0",
"0.62.0-beta1",
"0.62.0-beta2",
"0.62.0-beta3",
"0.62.0-beta4",
"0.62.0-beta5",
"0.62.0-beta6",
"0.62.0-beta7",
"0.63.0",
"0.63.1",
"0.63.2",
"0.64.0",
"0.64.1",
"0.64.2",
"0.65.0",
"0.66.0",
"0.67.0",
"0.68.0",
"0.68.1",
"0.69.0",
"0.69.1",
"0.69.10",
"0.69.2",
"0.69.3",
"0.69.4",
"0.69.5",
"0.69.6",
"0.69.7",
"0.69.8",
"0.69.9",
"0.7.0",
"0.7.1",
"0.7.2",
"0.7.3",
"0.7.4",
"0.8.0",
"0.9.0",
"0.9.1",
"0.9.2",
"1.0.0",
"1.0.1",
"1.1.0",
"1.2.0",
"1.2.1",
"1.3.0",
"1.3.1",
"1.3.10",
"1.3.11",
"1.3.12",
"1.3.13",
"1.3.14",
"1.3.2",
"1.3.3",
"1.3.4",
"1.3.5",
"1.3.6",
"1.3.7",
"1.3.8",
"1.3.9",
"2.0.0",
"2.1.0",
"2.1.1",
"2.1.10",
"2.1.11",
"2.1.12",
"2.1.13",
"2.1.2",
"2.1.3",
"2.1.4",
"2.1.5",
"2.1.6",
"2.1.7",
"2.1.8",
"2.1.9",
"2.2.0",
"2.2.1",
"2.2.2",
"2.2.3",
"2.2.4",
"2.2.5",
"2.2.6",
"2.2.7",
"2.3.0",
"2.3.1",
"2.3.2",
"2.3.3",
"2.3.4",
"2.3.5",
"2.3.6",
"2.3.7",
"2.4.0",
"2.5.0",
"2.6.0"
]
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-28T19:49:44Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nWith `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).\n\n## Impact\n\nAn attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:\n\n- uses `SslMode = VerifyCA` or `VerifyFull`, and\n- does not use the `SslCa` connection string option, and\n- uses a non-empty password.\n\nThe attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. \n\nNot affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server).\n\n## Workarounds\n\nProvide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication.\n\n## References\n\n- https://mariadb.org/mission-impossible-zero-configuration-ssl/",
"id": "GHSA-473q-m89c-ghf8",
"modified": "2026-10-28T20:00:04.871955012Z",
"published": "2026-10-28T19:49:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mysql-net/MySqlConnector/security/advisories/GHSA-473q-m89c-ghf8"
},
{
"type": "WEB",
"url": "https://github.com/mysql-net/MySqlConnector/commit/86503613fe3b72ae26c03dd1ea92f0e1e6e208f9"
},
{
"type": "PACKAGE",
"url": "https://github.com/mysql-net/MySqlConnector"
},
{
"type": "WEB",
"url": "https://github.com/mysql-net/MySqlConnector/releases/tag/2.6.1"
}
],
"schema_version": "1.9.2",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)"
}