{"answers":{"affected":"2 open source packages ship an affected version, including MySqlConnector.","exploited":"There is no known exploitation of GHSA-473q-m89c-ghf8 in the wild and no public exploit code.","fix":"Upgrade MySqlConnector to 2.6.1 or later.","what":"GHSA-473q-m89c-ghf8 is a vulnerability in MySqlConnector, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for GHSA-473q-m89c-ghf8 and fix it if it is affected.\n\nWhat it is: GHSA-473q-m89c-ghf8 is a vulnerability in MySqlConnector, published on 28 Oct 2026. \nExploitation: There is no known exploitation of GHSA-473q-m89c-ghf8 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- MySqlConnector (NuGet): affected all versions; fixed in 2.6.1\n- MySqlConnector (NuGet): affected all versions; fixed in 2.6.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-473q-m89c-ghf8/ (Markdown: https://insights.sbomify.com/GHSA-473q-m89c-ghf8/index.md)","id":"GHSA-473q-m89c-ghf8","markdown":"https://insights.sbomify.com/GHSA-473q-m89c-ghf8/index.md","name":"GHSA-473q-m89c-ghf8","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nWith `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).\n\n## Impact\n\nAn attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:\n\n- uses `SslMode = VerifyCA` or `VerifyFull`, and\n- does not use the `SslCa` connection string option, and\n- uses a non-empty password.\n\nThe attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. \n\nNot affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server).\n\n## Workarounds\n\nProvide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication.\n\n## References\n\n- https://mariadb.org/mission-impossible-zero-configuration-ssl/","ecosystems":["NuGet"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"With `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as s","id":"GHSA-473q-m89c-ghf8","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"NuGet","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"NuGet","fixed":["2.6.1"],"introduced":["0"],"last_affected":[],"package":"MySqlConnector","purl":null,"source":"GHSA-473q-m89c-ghf8"},{"ecosystem":"NuGet","fixed":["2.6.1"],"introduced":["0"],"last_affected":[],"package":"MySqlConnector","purl":"pkg:nuget/MySqlConnector","source":"GHSA-473q-m89c-ghf8"}],"products":null,"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/GHSA-473q-m89c-ghf8/"}