AIKIDO-2026-765062

TL;DR

The mysql2 driver registers mysql_clear_password as a default authentication plugin that returns the account password as a plaintext buffer. A rogue or man-in-the-middle MySQL server can send an authentication-switch request selecting mysql_clear_password, and the driver complies without requiring that the connection be encrypted. On unencrypted connections the client transmits the password in cleartext, letting the malicious endpoint capture credentials. The fix disables the cleartext plugin by default and requires explicit opt-in through the enableCleartextPlugin option or a custom auth plugin.