MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

影響: nuget:MySqlConnector < 2.6.1 → 2.6.1

With SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl). Impact An attacker who can deploy a man-in-the-middle MySQL proxy presenting…

Read on GitHub Advisory Database

On 10/29/2026, 04:49 AM, GitHub Advisory Database published "MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)" (type: Advisory). Severity is "Medium" (medium). Related technologies: .NET / C#, MySQL / MariaDB.