Vulnerability-Lookup

CVE-2026-65959 (GCVE-0-2026-65959)

Vulnerability from cvelistv5 – Published: 2026-08-18 18:18 – Updated: 2026-08-18 18:41

Title

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Summary

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 18:40 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/vitessio/vitess/security/advis…	x_refsource_CONFIRM
https://github.com/vitessio/vitess/commit/4c58cd7…	x_refsource_MISC
https://github.com/vitessio/vitess/commit/657662e…	x_refsource_MISC
https://github.com/vitessio/vitess/commit/d929225…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
vitessio	vitess	Affected: <= 24.0.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65959",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T18:40:57.573817Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T18:41:22.307Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vitess",
          "vendor": "vitessio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 24.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T18:18:46.919Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"
        },
        {
          "name": "https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f"
        },
        {
          "name": "https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094"
        },
        {
          "name": "https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"
        }
      ],
      "source": {
        "advisory": "GHSA-mhc4-g3wh-cw7m",
        "discovery": "UNKNOWN"
      },
      "title": "Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-65959",
    "datePublished": "2026-08-18T18:18:46.919Z",
    "dateReserved": "2026-07-23T18:15:14.579Z",
    "dateUpdated": "2026-08-18T18:41:22.307Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-65959",
      "date": "2026-10-16",
      "epss": "0.00426",
      "percentile": "0.3543"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-13T01:48:43.000Z",
      "cve": "CVE-2026-65959",
      "id": "msrc_CVE-2026-65959",
      "initial_release_date": "2026-08-20T21:59:42.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-65959.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "vitess",
                "vendor": "vitessio",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 24.0.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows"
          }
        ],
        "id": "CVE-2026-65959",
        "lastModified": "2026-09-18T20:05:53.723",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-65959",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T18:40:57.573817Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-18T19:17:00.223",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-65959",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-18T18:40:57.573817Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-18T18:41:18.076Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "vitess",
              "vendor": "vitessio",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 24.0.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-18T18:18:46.919Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"
            },
            {
              "name": "https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f"
            },
            {
              "name": "https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094"
            },
            {
              "name": "https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"
            }
          ],
          "source": {
            "advisory": "GHSA-mhc4-g3wh-cw7m",
            "discovery": "UNKNOWN"
          },
          "title": "Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-65959",
        "datePublished": "2026-08-18T18:18:46.919Z",
        "dateReserved": "2026-07-23T18:15:14.579Z",
        "dateUpdated": "2026-08-18T18:41:22.307Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-65959

Vulnerability from fkie_nvd - Published: 2026-08-18 19:17 - Updated: 2026-09-18 20:05

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f
	security-advisories@github.com	https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094
	security-advisories@github.com	https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb
	security-advisories@github.com	https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vitess",
          "vendor": "vitessio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 24.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows"
    }
  ],
  "id": "CVE-2026-65959",
  "lastModified": "2026-09-18T20:05:53.723",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-65959",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-18T18:40:57.573817Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-18T19:17:00.223",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-MHC4-G3WH-CW7M

Vulnerability from github – Published: 2026-08-18 20:50 – Updated: 2026-09-02 15:26

Summary

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Details

Vulnerability Details

File: go/vt/vttablet/tabletmanager/vreplication/vrlog.go

Summary

vttablet's /debug/vrlog HTTP endpoint streams live VReplication event data — including the literal SQL DML statements being replicated by MoveTables, Reshard, Materialize, and "vitess"-strategy Online DDL workflows — with no authorization check at all. Every comparable "debugging" HTTP endpoint in vttablet/vtgate (querylogz, queryz, txlogz, livequeryz, schemaz, debugenv, hotrows, tablet_plans, query_stats, query_rules) calls acl.CheckAccessHTTP(r, acl.DEBUGGING) before serving data, so that the cluster operator's configured --security-policy (e.g. deny-all, read-only, or a custom plugin) is actually honored. vrlog.go is the one exception: it has zero references to the acl package.

Root Cause

addHttpEndpoint() registers /debug/vrlog via servenv.HTTPHandleFunc, and vrlogStatsHandler() immediately starts streaming subscribed VrLogStats events to the response writer without first calling acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike every sibling handler in the same family (see e.g. go/vt/vttablet/tabletserver/querylogz.go's querylogzHandler, which calls the check first).

The data streamed is sensitive: go/vt/vttablet/tabletmanager/vreplication/vplayer.go calls NewVrLogStats(...).Send(sql) / .Send(event.Statement) for every row change and statement event flowing through a VReplication stream (vplayer.go:339, 700, 771, 785) — i.e. the literal SQL (including bound data values) being copied/replicated by MoveTables, Reshard, Materialize, and Online DDL.

Attack Scenario

A cluster operator configures --security-policy=deny-all (or read-only, or a custom policy) specifically to lock down debugging/admin HTTP endpoints on vttablet, relying on this being uniformly enforced.
An attacker who can reach the vttablet debug HTTP port (common in Kubernetes/Prometheus-scraping deployments where this port is exposed beyond localhost) — but who does NOT have the DEBUGGING/admin role the policy requires — sends GET /debug/vrlog.
Every other debug endpoint correctly returns 403 Forbidden. /debug/vrlog returns 200 OK and streams live VReplication event data, including raw SQL DML statements containing application data values, for as long as the attacker keeps the connection open (bounded by timeout/limit query params, repeatable).

Impact

Confidentiality impact: disclosure of live replicated application data (potentially including PII or other sensitive column values) to an unauthorized actor, bypassing an access control the operator explicitly configured. No write/modify capability; this is a read-only information-disclosure / access-control-bypass issue, scoped to the vttablet debug HTTP listener.

Vulnerable Code

// go/vt/vttablet/tabletmanager/vreplication/vrlog.go
func addHttpEndpoint() {
    servenv.HTTPHandleFunc("/debug/vrlog", func(w http.ResponseWriter, r *http.Request) {
        ch := vrLogStatsLogger.Subscribe("vrlogstats")
        defer vrLogStatsLogger.Unsubscribe(ch)
        vrlogStatsHandler(ch, w, r)
    })
}

func vrlogStatsHandler(ch chan *VrLogStats, w http.ResponseWriter, r *http.Request) {
    timeout, limit := parseTimeoutLimitParams(r)
    // no acl.CheckAccessHTTP(r, acl.DEBUGGING) call anywhere in this file
    ...

Recommended Fix

import "vitess.io/vitess/go/acl"

func vrlogStatsHandler(ch chan *VrLogStats, w http.ResponseWriter, r *http.Request) {
    if err := acl.CheckAccessHTTP(r, acl.DEBUGGING); err != nil {
        acl.SendError(w, err)
        return
    }
    timeout, limit := parseTimeoutLimitParams(r)
    ...

This mirrors the exact pattern already used by querylogz.go, queryz.go, txlogz.go, livequeryz.go, schemaz.go, debugenv.go, and tx_serializer.go (hotrows) in the same codebase.

Verification

Built v24.0.1 from source and wrote a standalone Go test that: (1) activates the real deny-all security policy via acl.RegisterFlags, (2) registers /debug/vrlog via the real, unmodified vreplication.NewVrLogStats(...) call path (the same one vplayer.go uses for live replication traffic), (3) serves the real servenv HTTP mux on a loopback listener, and (4) issues a real GET /debug/vrlog while emitting a simulated replicated statement.

Result:

acl.CheckAccessHTTP(DEBUGGING) under deny-all => err=not allowed: deny-all security-policy enforced
GET /debug/vrlog under deny-all => status=200 body="ROWCHANGE Event\tINSERT INTO secret_table (ssn) VALUES ('leaked-via-vrlog')\t2026-06-22T11:01:55\t147101\n"

The identical ACL check that protects every sibling endpoint correctly rejected the request, while /debug/vrlog returned 200 and streamed the simulated sensitive content — confirming the bypass against real, unmodified v24.0.1 code.

Also confirmed via the GitHub Contents API that vrlog.go has zero references to the acl package on main, release-23.0, and release-22.0 as well, so all currently supported release lines appear affected.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "vitess.io/vitess"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.24.0-rc1"
            },
            {
              "last_affected": "0.24.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "vitess.io/vitess"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.23.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-65959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T20:50:54Z",
    "nvd_published_at": "2026-08-18T19:17:00Z",
    "severity": "MODERATE"
  },
  "details": "## Vulnerability Details\n\n**File**: `go/vt/vttablet/tabletmanager/vreplication/vrlog.go`\n\n### Summary\n`vttablet`\u0027s `/debug/vrlog` HTTP endpoint streams live VReplication event data \u2014 including the literal SQL DML statements being replicated by MoveTables, Reshard, Materialize, and \"vitess\"-strategy Online DDL workflows \u2014 with no authorization check at all. Every comparable \"debugging\" HTTP endpoint in vttablet/vtgate (querylogz, queryz, txlogz, livequeryz, schemaz, debugenv, hotrows, tablet_plans, query_stats, query_rules) calls `acl.CheckAccessHTTP(r, acl.DEBUGGING)` before serving data, so that the cluster operator\u0027s configured `--security-policy` (e.g. `deny-all`, `read-only`, or a custom plugin) is actually honored. `vrlog.go` is the one exception: it has zero references to the `acl` package.\n\n### Root Cause\n`addHttpEndpoint()` registers `/debug/vrlog` via `servenv.HTTPHandleFunc`, and `vrlogStatsHandler()` immediately starts streaming subscribed `VrLogStats` events to the response writer without first calling `acl.CheckAccessHTTP(r, acl.DEBUGGING)`, unlike every sibling handler in the same family (see e.g. `go/vt/vttablet/tabletserver/querylogz.go`\u0027s `querylogzHandler`, which calls the check first).\n\nThe data streamed is sensitive: `go/vt/vttablet/tabletmanager/vreplication/vplayer.go` calls `NewVrLogStats(...).Send(sql)` / `.Send(event.Statement)` for every row change and statement event flowing through a VReplication stream (vplayer.go:339, 700, 771, 785) \u2014 i.e. the literal SQL (including bound data values) being copied/replicated by MoveTables, Reshard, Materialize, and Online DDL.\n\n### Attack Scenario\n1. A cluster operator configures `--security-policy=deny-all` (or `read-only`, or a custom policy) specifically to lock down debugging/admin HTTP endpoints on vttablet, relying on this being uniformly enforced.\n2. An attacker who can reach the vttablet debug HTTP port (common in Kubernetes/Prometheus-scraping deployments where this port is exposed beyond localhost) \u2014 but who does NOT have the `DEBUGGING`/admin role the policy requires \u2014 sends `GET /debug/vrlog`.\n3. Every other debug endpoint correctly returns `403 Forbidden`. `/debug/vrlog` returns `200 OK` and streams live VReplication event data, including raw SQL DML statements containing application data values, for as long as the attacker keeps the connection open (bounded by `timeout`/`limit` query params, repeatable).\n\n### Impact\nConfidentiality impact: disclosure of live replicated application data (potentially including PII or other sensitive column values) to an unauthorized actor, bypassing an access control the operator explicitly configured. No write/modify capability; this is a read-only information-disclosure / access-control-bypass issue, scoped to the vttablet debug HTTP listener.\n\n### Vulnerable Code\n```go\n// go/vt/vttablet/tabletmanager/vreplication/vrlog.go\nfunc addHttpEndpoint() {\n\tservenv.HTTPHandleFunc(\"/debug/vrlog\", func(w http.ResponseWriter, r *http.Request) {\n\t\tch := vrLogStatsLogger.Subscribe(\"vrlogstats\")\n\t\tdefer vrLogStatsLogger.Unsubscribe(ch)\n\t\tvrlogStatsHandler(ch, w, r)\n\t})\n}\n\nfunc vrlogStatsHandler(ch chan *VrLogStats, w http.ResponseWriter, r *http.Request) {\n\ttimeout, limit := parseTimeoutLimitParams(r)\n\t// no acl.CheckAccessHTTP(r, acl.DEBUGGING) call anywhere in this file\n\t...\n```\n\n### Recommended Fix\n```go\nimport \"vitess.io/vitess/go/acl\"\n\nfunc vrlogStatsHandler(ch chan *VrLogStats, w http.ResponseWriter, r *http.Request) {\n\tif err := acl.CheckAccessHTTP(r, acl.DEBUGGING); err != nil {\n\t\tacl.SendError(w, err)\n\t\treturn\n\t}\n\ttimeout, limit := parseTimeoutLimitParams(r)\n\t...\n```\nThis mirrors the exact pattern already used by `querylogz.go`, `queryz.go`, `txlogz.go`, `livequeryz.go`, `schemaz.go`, `debugenv.go`, and `tx_serializer.go` (hotrows) in the same codebase.\n\n### Verification\nBuilt v24.0.1 from source and wrote a standalone Go test that: (1) activates the real `deny-all` security policy via `acl.RegisterFlags`, (2) registers `/debug/vrlog` via the real, unmodified `vreplication.NewVrLogStats(...)` call path (the same one `vplayer.go` uses for live replication traffic), (3) serves the real `servenv` HTTP mux on a loopback listener, and (4) issues a real `GET /debug/vrlog` while emitting a simulated replicated statement.\n\nResult:\n```\nacl.CheckAccessHTTP(DEBUGGING) under deny-all =\u003e err=not allowed: deny-all security-policy enforced\nGET /debug/vrlog under deny-all =\u003e status=200 body=\"ROWCHANGE Event\\tINSERT INTO secret_table (ssn) VALUES (\u0027leaked-via-vrlog\u0027)\\t2026-06-22T11:01:55\\t147101\\n\"\n```\nThe identical ACL check that protects every sibling endpoint correctly rejected the request, while `/debug/vrlog` returned 200 and streamed the simulated sensitive content \u2014 confirming the bypass against real, unmodified v24.0.1 code.\n\nAlso confirmed via the GitHub Contents API that `vrlog.go` has zero references to the `acl` package on `main`, `release-23.0`, and `release-22.0` as well, so all currently supported release lines appear affected.",
  "id": "GHSA-mhc4-g3wh-cw7m",
  "modified": "2026-09-02T15:26:56Z",
  "published": "2026-08-18T20:50:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65959"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/pull/20467"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitessio/vitess"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data"
}

MSRC_CVE-2026-65959

Vulnerability from csaf_microsoft - Published: 2026-08-20 21:59 - Updated: 2026-09-13 01:48

Summary

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Scope

1 vulnerability in this advisory, including CVE-2026-65959.

CVE-2026-65959

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fixed: 2 products Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-65959 (GCVE-0-2026-65959)

FKIE_CVE-2026-65959

GHSA-MHC4-G3WH-CW7M

Vulnerability Details

Summary

Root Cause

Attack Scenario

Impact

Vulnerable Code

Recommended Fix

Verification

MSRC_CVE-2026-65959

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour