MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)

影響: nuget:MySqlConnector < 2.6.1 → 2.6.1

With SslMode set to VerifyCA or VerifyFull with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl). Impact An attacker who can deploy a man-in-the-middle MySQL proxy presenting…

在 GitHub Advisory Database 阅读

2026/10/29 04:49，GitHub Advisory Database 发布了“MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：.NET / C#、MySQL / MariaDB。