CVE-2026-65959
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
MEDIUM 5.3
At a glance
- Source
- NVD
- EPSS
- EPSS 0.43 % · percentile 37 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Undergoing Analysis
Description
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
- https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m
- https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f
- https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094
- https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-mhc4-g3wh-cw7m — Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
- GO-2026-6356 — Missing authorization on vttablet /debug/vrlog in vitess.io/vitess
European references
- ENISA EUVD · EUVD-2026-61106
- GCVE · GCVE-0-2026-65959
Affected products
| Product | Versions |
|---|---|
| vitessio · vitess | affected <= 24.0.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |