# GHSA-473q-m89c-ghf8: With `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as s


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 28 Oct 2026

## What is GHSA-473q-m89c-ghf8?

GHSA-473q-m89c-ghf8 is a vulnerability in MySqlConnector, published on 28 Oct 2026. 

### Official description

## Summary

With `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl).

## Impact

An attacker who can deploy a man-in-the-middle MySQL proxy presenting any self-signed certificate can capture the plaintext database password of a client that:

- uses `SslMode = VerifyCA` or `VerifyFull`, and
- does not use the `SslCa` connection string option, and
- uses a non-empty password.

The attacker completes the TLS handshake with its own cert, requests a clear-text password authentication scheme (`mysql_clear_password`, or forces the `caching_sha2_password`/`sha256_password` clear-text fallback), and receives the password before the fingerprint check rejects the connection, defeating the man-in-the-middle protection `VerifyFull` is expected to provide. 

Not affected: a configured CA (`SslCa`), CA-validated TLS, local connections (Unix socket / loopback), or empty passwords. Using `SslMode` set to `Preferred` or `Required` is out of scope (this is documented as not authenticating the server).

## Workarounds

Provide `SslCa` with `VerifyCA`/`VerifyFull`, use a local/Unix-socket connection, or avoid clear-text authentication.

## References

- https://mariadb.org/mission-impossible-zero-configuration-ssl/

## Which versions are affected by GHSA-473q-m89c-ghf8?

2 open source packages ship an affected version, including MySqlConnector.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `MySqlConnector` | NuGet | All versions | 2.6.1 |
| `MySqlConnector` | NuGet | All versions | 2.6.1 |

## How do I fix GHSA-473q-m89c-ghf8?

Upgrade MySqlConnector to 2.6.1 or later.

## Is GHSA-473q-m89c-ghf8 being exploited?

There is no known exploitation of GHSA-473q-m89c-ghf8 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-473q-m89c-ghf8 and fix it if it is affected.

What it is: GHSA-473q-m89c-ghf8 is a vulnerability in MySqlConnector, published on 28 Oct 2026. 
Exploitation: There is no known exploitation of GHSA-473q-m89c-ghf8 in the wild and no public exploit code.

Affected packages and fixed versions:
- MySqlConnector (NuGet): affected all versions; fixed in 2.6.1
- MySqlConnector (NuGet): affected all versions; fixed in 2.6.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-473q-m89c-ghf8/ (Markdown: https://insights.sbomify.com/GHSA-473q-m89c-ghf8/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-473q-m89c-ghf8

---
From sbomify Insights: https://insights.sbomify.com/GHSA-473q-m89c-ghf8/
Summaries are generated and may contain mistakes; the official description above is the record.