CVE-2022-31011: TiDB authentication bypass vulnerability

June 6, 2022 (updated July 9, 2025)

Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability.

References

github.com/advisories/GHSA-4whx-7p29-mq22
github.com/pingcap/tidb
github.com/pingcap/tidb/releases/tag/v5.3.1
github.com/pingcap/tidb/security/advisories/GHSA-4whx-7p29-mq22
nvd.nist.gov/vuln/detail/CVE-2022-31011

Code Behaviors & Features

Detect and mitigate CVE-2022-31011 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →