GHSA-473q-m89c-ghf8: MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

October 28, 2026

With SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB’s zero-configuration TLS.

References

github.com/advisories/GHSA-473q-m89c-ghf8
github.com/mysql-net/MySqlConnector/commit/86503613fe3b72ae26c03dd1ea92f0e1e6e208f9
github.com/mysql-net/MySqlConnector/releases/tag/2.6.1
github.com/mysql-net/MySqlConnector/security/advisories/GHSA-473q-m89c-ghf8

Code Behaviors & Features

Detect and mitigate GHSA-473q-m89c-ghf8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →