{"id":"ghsa-ghsa-473q-m89c-ghf8","seq":2056994,"kind":"advisory","title":"MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)","url":"https://github.com/advisories/GHSA-473q-m89c-ghf8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-473q-m89c-ghf8","summary":"影響: nuget:MySqlConnector < 2.6.1 → 2.6.1\nWith SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl). Impact An attacker who can deploy a man-in-the-middle MySQL proxy presenting…","severity":"medium","techs":["dotnet","mysql"],"cves":[],"tags":["GHSA-473q-m89c-ghf8","MySqlConnector"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:49:44.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}