GHSA-3f6p-5ww8-9rcrHigh▾ TwilightMySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A rogue MySQL server (or MITM) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.
mysql_clear_password is registered as a default standard plugin in lib/commands/auth_switch.js (line 21). When a server sends an AuthSwitchRequest (0xFE) requesting mysql_clear_password, the driver executes it without checking for TLS. The plugin (lib/auth_plugins/mysql_clear_password.js) returns Buffer.from(password + '\0').
Note: caching_sha2_password plugin DOES check for SSL before sending cleartext (line 77). But mysql_clear_password has no such guard.
caching_sha2_password in handshakemysql_clear_passwordRogue MySQL server (Node.js, ~80 lines) that captures plaintext passwords from mysql2 clients. Tested against mysql2 3.20.0. Full PoC available on request.
Remove mysql_clear_password from standardAuthPlugins, or add a guard requiring TLS/unix socket before allowing cleartext auth.
mysql2 < 3.22.0Upgrade to a patched release:
mysql2 3.22.0Connected by shared product, vendor, weakness, or advisory.
CVE-2020-5404Medium· 5.9The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain
CVE-2019-11284High· 8.6Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones
CVE-2021-30116Critical· 10.0Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021
CVE-2026-59158High· 7.5Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
CVE-2026-76969Critical· 9.4@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled
GHSA-vx52-2968-3vc6High· 7.4pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml