GHSA-3f6p-5ww8-9rcr MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Not scored Published 1 Sep 2026

A rogue MySQL server can force the mysql2 driver to send plaintext credentials by downgrading authentication, allowing attackers to steal passwords.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-3f6p-5ww8-9rcr?

GHSA-3f6p-5ww8-9rcr is a vulnerability in mysql2, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Summary

A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

Details

mysql_clear_password is registered as a default standard plugin in lib/commands/auth_switch.js (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting mysql_clear_password, the driver executes it without checking for TLS. The plugin (lib/auth_plugins/mysql_clear_password.js) returns Buffer.from(password + '\0').

Note: caching_sha2_password plugin DOES check for SSL before sending cleartext (line 77). But mysql_clear_password has no such guard.

Attack Scenario

Attacker operates rogue MySQL server or performs MITM
Server advertises caching_sha2_password in handshake
Client sends hashed auth response
Server replies with AuthSwitchRequest to mysql_clear_password
Client sends password in plaintext
Attacker captures plaintext password

PoC

Rogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.

Suggested Fix

Remove mysql_clear_password from standardAuthPlugins, or add a guard requiring TLS/unix socket before allowing cleartext auth.

Impact

mysql2: 9M weekly downloads
Any application connecting without TLS is vulnerable to credential theft
Cloud environments with untrusted network paths are especially at risk

Which versions are affected by GHSA-3f6p-5ww8-9rcr?

2 open source packages ship an affected version, including mysql2.

Package	Affected	Fixed in
`mysql2` npm	All versions	`3.22.0`
`mysql2` npm	All versions	`3.22.0`

How do I fix GHSA-3f6p-5ww8-9rcr?

Upgrade mysql2 to 3.22.0 or later.

Is GHSA-3f6p-5ww8-9rcr being exploited?

There is no known exploitation of GHSA-3f6p-5ww8-9rcr in the wild and no public exploit code.