Bulletin ID	MET-2026-004
Date (published)	2026-11-03T00:00:00.000Z
Date (last updated)	2026-11-03T00:00:00.000Z
Severity	Informational

Description

On October 28th, 2026, a vulnerability was published in MySqlConnector, the .NET driver the game server uses to connect to MySQL. When a connection has SslMode set to VerifyCA or VerifyFull but no CA certificate configured with SslCa, MySqlConnector can send the database password in clear text before it has checked the server's TLS certificate. An attacker who can put a man-in-the-middle MySQL proxy with any self-signed certificate between the client and the database can capture the password.

All versions of MySqlConnector before 2.6.1 are affected. The vulnerability is fixed in version 2.6.1.

Affected Products/Services

Metaplay infrastructure and product are not affected by this vulnerability.

• The game server builds its MySQL connection string in DatabaseBackendMySql and does not set SslMode, so MySqlConnector uses its default, Preferred. The advisory applies only to VerifyCA and VerifyFull, and lists Preferred and Required as out of scope.
• The connection string is not configurable through runtime options, so a game cannot switch to an affected mode without modifying the SDK.

Impact

None.

Solution

As MetaplaySDK is not affected, no action is required.

MetaplaySDK release 39 updates MySqlConnector to version 2.6.2. To silence the NU1902 build warning emitted by NuGet's security audit before that, update the package reference in the project file. The patch applies to MetaplaySDK versions 36, 37 and 38, which all reference version 2.5.0.

MetaplaySDK/Backend/Cloud/Metaplay.Cloud.csproj

-   <PackageReference Include="MySqlConnector" Version="2.5.0" />
+   <PackageReference Include="MySqlConnector" Version="2.6.2" />

CVE and CVSS Information

• No CVE has been assigned.
• CVSS v4.0 base score 6.9 (Moderate): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• GHSA-473q-m89c-ghf8
• MySqlConnector 2.6.1 release

Contact Information

Security-related questions or concerns can be sent to security@metaplay.io.

Revision History

Date	Description
2026-11-03	Security Bulletin released