Log in Start free

Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M

CVE-2026-65959Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Medium 5.3

In plain English

A medium-severity missing authorization in vitess from vitessio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 65.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Govitess.io/vitessno fix listedGHSA-mhc4-g3wh-cw7m
Govitess.io/vitessno fix listedGHSA-mhc4-g3wh-cw7m
Govitess.io/vitess0.23.6, 0.24.3GO-2026-6356

Affected products (as reported)

VendorProductVersions
vitessio vitess <= 24.0.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References