MySQL proxy sends no password to backend (using password: NO) on MySQL 8.4.10 / Warpgate v0.26.1

[HenricoSanches]

MySQL proxy sends no password to backend (using password: NO) on MySQL 8.4.10 / Warpgate v0.26.1

Environment

• Warpgate: v0.26.1
• Docker (ghcr.io/warp-tech/warpgate:latest)
• Ubuntu 24.04
• Backend:
  • MySQL Community Server 8.4.10
• Also reproduced with MySQL 8.0.x
• Client:
  • MySQL CLI

Target configuration

Authentication:

• Username: warpgate
• Password authentication
• TLS: Disabled

Backend:

• Host: 192.168.1.175
• Port: 3306

Client connection

mysql \
-u "admin#MySQL-VM" \
-h <warpgate-ip> \
-P 33306 \
-p \
--ssl-mode=REQUIRED \
--enable-cleartext-plugin

After authenticating successfully against Warpgate, executing:

SELECT VERSION();

results in:

ERROR 2013 (HY000): Lost connection to server during query

Backend MySQL log

The backend MySQL server logs:

Access denied for user 'warpgate'@'<warpgate-ip>' (using password: NO)

This suggests that Warpgate is connecting to the backend without sending a password, even though password authentication is configured.

What I have already verified

Direct connection works

Connecting directly from the Warpgate host to MySQL succeeds:

mysql -h 192.168.1.175 -u warpgate -p

So the following have been verified:

• ✅ username is correct
• ✅ password is correct
• ✅ network connectivity is correct
• ✅ host permissions are correct
• ✅ MySQL accepts the credentials normally

Authentication plugin

The backend user uses:

mysql_native_password

SQLite configuration

I inspected Warpgate's SQLite database inside the container.

The target is stored correctly, including the password:

{
  "mysql": {
    "auth": {
      "kind": "password",
      "password": "Warpgate@123"
    },
    "host": "192.168.1.175",
    "port": 3306,
    "username": "warpgate",
    "tls": {
      "mode": "disabled"
    }
  }
}

Therefore, the password is correctly persisted by Warpgate.

Previous errors observed

During troubleshooting I also encountered:

Client does not support authentication protocol requested by server

and earlier:

invalid peer certificate: UnknownIssuer

After disabling TLS on the target, the only remaining error is:

Access denied for user 'warpgate'@'<warpgate-ip>' (using password: NO)

Expected behavior

Warpgate should authenticate successfully to the backend MySQL server using the configured password and proxy the session.

Actual behavior

The backend receives a connection attempt without a password, even though the password is configured and stored correctly.

Question

Is this a known issue with the MySQL proxy in Warpgate v0.26.1?

I'd be happy to provide:

• complete Warpgate logs
• MySQL logs
• SQLite database
• Docker Compose
• steps to reproduce

[Eugeny]

Could you double check that mysql_native_password is enabled on the server? MySQL 8.4 specifically defaults to caching_sha2_password which is only supported in the nightly

[HenricoSanches]

Thanks for the reply.

Yes, the backend user is explicitly configured with mysql_native_password.

SHOW CREATE USER 'warpgate'@'%';

returns:

IDENTIFIED WITH mysql_native_password

I can also connect directly from the Warpgate host using:

mysql -h 192.168.1.175 -u warpgate -p

with the same credentials without any issue.

Is there another server-side check you would recommend to verify that mysql_native_password is enabled globally?