GO-2026-6356
Missing authorization on vttablet /debug/vrlog in vitess.io/vitess
At a glance
- Published
- Updated
- CVE
- CVE-2026-65959
- Aliases
- GHSA-mhc4-g3wh-cw7m
Description
The vttablet /debug/vrlog HTTP endpoint streams live VReplication event data, including SQL statements and table row changes, without verifying authorization via acl.CheckAccessHTTP. An unauthenticated actor with network access to the debug endpoint can stream live replicated SQL data.
Affected packages
| Package | Versions |
|---|---|
| Go · vitess.io/vitess | introduced 0, fixed 0.23.6, introduced 0.24.0-rc1, fixed 0.24.3 |
References
- https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m ADVISORY
- https://github.com/vitessio/vitess/pull/20467 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |