# MySQL2 auth plugin downgrade to mysql_clear_password leaks plaintext credentials

Source: https://junglewise.ai/threats/mysql2-auth-plugin-downgrade-to-mysql-clear-password-leaks-plaintext-4f504449  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.2 · Published 2026-09-01

MySQL2 is a popular Node.js library for connecting to MySQL databases, with millions of weekly downloads. A rogue or compromised MySQL server can trick the library into sending database credentials in plaintext by requesting a switch to the mysql_clear_password authentication method. Applications connecting without TLS encryption are vulnerable to credential theft through network interception or man-in-the-middle attacks.

Technologies: [mysql2 (npm)](https://junglewise.ai/threats/technologies/mysql2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.2, published 1 September 2026.

**Which products and versions are affected?** mysql2 (npm) < 3.22.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-04-10: Patch released in v3.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected?** Check whether you run mysql2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The mysql_clear_password authentication plugin is enabled by default in mysql2 and is registered as a standard authentication method in lib/commands/auth_switch.js. When a MySQL server sends an AuthSwitchRequest (0xFE) packet requesting mysql_clear_password, the driver executes it without validating that a TLS connection is active, unlike the caching_sha2_password plugin which includes such a check. An attacker operating a rogue MySQL server or performing a man-in-the-middle attack can advertise caching_sha2_password during the initial handshake, accept the client's hashed authentication response, then request a switch to mysql_clear_password. The vulnerable driver will comply and transmit the plaintext password. The vulnerability was fixed in version 3.22.0 by disabling the mysql_clear_password plugin by default and requiring explicit opt-in via the enableCleartextPlugin configuration option or by providing a custom auth plugin.

## Affected products

- sidorares mysql2 < 3.22.0

## Timeline

- 2026-07-19: disclosed
- 2026-09-01: advisory
- 2026-04-10: patched: Patch released in v3.22.0

## References

- [https://github.com/sidorares/node-mysql2/security/advisories/GHSA-3f6p-5ww8-9rcr](https://github.com/sidorares/node-mysql2/security/advisories/GHSA-3f6p-5ww8-9rcr)
- [https://github.com/sidorares/node-mysql2/issues/1617](https://github.com/sidorares/node-mysql2/issues/1617)
- [https://github.com/sidorares/node-mysql2/pull/4236](https://github.com/sidorares/node-mysql2/pull/4236)
- [https://github.com/sidorares/node-mysql2/commit/884bec56288d827939d0dd3f1f4ae476fbc8dbeb](https://github.com/sidorares/node-mysql2/commit/884bec56288d827939d0dd3f1f4ae476fbc8dbeb)
- [https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0](https://github.com/sidorares/node-mysql2/releases/tag/v3.22.0)
- [https://api.github.com/repos/sidorares/node-mysql2/security-advisories/GHSA-3f6p-5ww8-9rcr](https://api.github.com/repos/sidorares/node-mysql2/security-advisories/GHSA-3f6p-5ww8-9rcr)

## Related threats

- [MySQL2 unbounded zlib inflate decompression-bomb DoS](https://junglewise.ai/threats/mysql2-unbounded-zlib-inflate-decompression-bomb-dos-1b8791b1)
- [mysql2 prototype pollution in nestTables](https://junglewise.ai/threats/cve-2024-21512-mysql2-prototype-pollution-in-nesttables)
- [mysql2 for Node arbitrary code injection via timezone parameter](https://junglewise.ai/threats/cve-2024-21511-mysql2-for-node-arbitrary-code-injection-via-timezone-parameter)
- [mysql2 remote code execution in readCodeFor function](https://junglewise.ai/threats/cve-2024-21508-mysql2-remote-code-execution-in-readcodefor-function)
- [mysql2 prototype poisoning in result parser](https://junglewise.ai/threats/cve-2024-21509-mysql2-prototype-poisoning-in-result-parser)