Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.2, published 1 September 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-04-10: Patch released in v3.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network or from the adjacent network, in a software library.

Check whether you run mysql2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

MySQL2 auth plugin downgrade to mysql_clear_password leaks plaintext credentials

Severity: high · CVSS 8.2 · Published 2026-09-01

MySQL2 is a popular Node.js library for connecting to MySQL databases, with millions of weekly downloads. A rogue or compromised MySQL server can trick the library into sending database credentials in plaintext by requesting a switch to the mysql_clear_password authentication method. Applications connecting without TLS encryption are vulnerable to credential theft through network interception or man-in-the-middle attacks.

Technologies: mysql2 (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.2, published 1 September 2026.
Which products and versions are affected?: mysql2 (npm) < 3.22.0.
Is there a fix for This vulnerability?: A patch was published on 2026-04-10: Patch released in v3.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected?: Check whether you run mysql2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The mysql_clear_password authentication plugin is enabled by default in mysql2 and is registered as a standard authentication method in lib/commands/auth_switch.js. When a MySQL server sends an AuthSwitchRequest (0xFE) packet requesting mysql_clear_password, the driver executes it without validating that a TLS connection is active, unlike the caching_sha2_password plugin which includes such a check. An attacker operating a rogue MySQL server or performing a man-in-the-middle attack can advertise caching_sha2_password during the initial handshake, accept the client's hashed authentication response, then request a switch to mysql_clear_password. The vulnerable driver will comply and transmit the plaintext password. The vulnerability was fixed in version 3.22.0 by disabling the mysql_clear_password plugin by default and requiring explicit opt-in via the enableCleartextPlugin configuration option or by providing a custom auth plugin.

Affected products

sidorares mysql2 < 3.22.0

Timeline

2026-07-19: disclosed
2026-09-01: advisory
2026-04-10: patched: Patch released in v3.22.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.