Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | vitess | up to 24.0.2 | — | No fix listed | CNA |
| — | vitess.io/vitess (Go) | 0.24.0-rc1 – 0.24.2 | — | No fix listed | GHSA-mhc4-g3wh-cw7m |
| — | vitess.io/vitess (Go) | up to 0.23.6 | — | No fix listed | GHSA-mhc4-g3wh-cw7m |
- vitess Vendorbackstage Affected up to 24.0.2 Fixed in — No fix listed CNA
- vitess.io/vitess (Go) Vendor— Affected 0.24.0-rc1 – 0.24.2 Fixed in — No fix listed GHSA-mhc4-g3wh-cw7m
- vitess.io/vitess (Go) Vendor— Affected up to 0.23.6 Fixed in — No fix listed GHSA-mhc4-g3wh-cw7m
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-65959
- 2026-10-03 Alias added: GHSA-mhc4-g3wh-cw7m
References
Patch 4
- https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m
- https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f
- https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094
- https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb
More backstage Vitess vulnerabilities
- TI-2026-22308 Vitess users with backup storage access can gain unauthorized access to production deployment environments CVSS 4.0HIGH 8.4
- TI-2026-73584 Reflected cross-site scripting in Vitess vttablet /twopcz endpoint CVSS 3.1CRITICAL 9.8
- TI-2026-22312 Vitess users with backup storage access can write to arbitrary file paths on restore CVSS 4.0CRITICAL 9.3
- TI-2023-13623 Vitess VTAdmin users that can create shards can deny access to other functions CVSS 3.1MEDIUM 4.3
- TI-2023-13622 vitess allows users to create keyspaces that can deny access to already existing keyspaces CVSS 3.1MEDIUM 4.1
Sources
- CVE-2026-65959 · CVE Program
- CVE-2026-65959 · NVD
- FIRST EPSS
- GHSA-mhc4-g3wh-cw7m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences