Mysql2 (< 3.22.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mysql2--3.22.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 01 Sep 2026 18:00:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMySQL2 Auth Plugin Downgrade Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-09-mysql2-cleartext-auth/Tue, 01 Sep 2026 18:00:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-mysql2-cleartext-auth/The mysql2 Node.js database driver is vulnerable to credential theft because it does not enforce TLS before executing a requested authentication switch to the mysql_clear_password plugin.The mysql2 package for Node.js is susceptible to credential interception due to insecure implementation of the mysql_clear_password authentication plugin. When a client connects to a server, the authentication process is managed by a list of standard plugins. An attacker operating a rogue MySQL server or performing a man-in-the-middle (MITM) attack can issue an AuthSwitchRequest (0xFE) to downgrade the authentication method to mysql_clear_password. Unlike other plugins, such as caching_sha2_password, the mysql2 driver fails to verify if a secure TLS connection is established before transmitting the password in plaintext. This flaw affects all versions of mysql2 prior to 3.22.0. With approximately 9 million weekly downloads, this vulnerability poses a significant risk to applications in environments where network traffic is not fully encrypted, particularly those traversing untrusted or internal network segments.

Attack Chain

  1. Attacker establishes a rogue MySQL server or performs a MITM position between the application and the legitimate database.
  2. The mysql2 client initiates a connection to the database.
  3. The rogue server responds with an initial handshake advertising support for caching_sha2_password.
  4. The client sends a hashed authentication response as expected by the protocol.
  5. The rogue server ignores the response and issues an AuthSwitchRequest (0xFE) command.
  6. The AuthSwitchRequest specifically requests the mysql_clear_password authentication plugin.
  7. The mysql2 driver, failing to check for an active SSL/TLS layer, invokes the mysql_clear_password plugin.
  8. The driver transmits the plaintext database password to the rogue server, where the attacker captures it.

Impact

The vulnerability results in the exposure of database credentials in plaintext. This impacts any application using mysql2 (< 3.22.0) that has not explicitly enforced TLS connections for all database communications. Given the library's high volume of weekly downloads (9 million), this poses a systemic risk to enterprise applications, particularly in cloud-native environments where network paths between services may be intercepted or spoofed.

Recommendation

  • Upgrade the mysql2 package to version 3.22.0 or later immediately to include the mandatory TLS check for authentication plugins.
  • Enforce SSL/TLS connections for all database configurations within the application code to prevent unauthorized downgrades.
  • Audit network egress traffic from application servers to identify unexpected connections to database ports (default 3306) targeting unauthorized infrastructure.
  • Implement network-level segmentation and mutual TLS (mTLS) for database communications to mitigate the impact of rogue or compromised database nodes.
]]>highadvisorycredential-accessvulnerabilitynodejs