Description
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows
Published: 2026-08-18
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The bug lies in a debug endpoint that lacks the required authorization check. The /debug/vrlog handler streams VrLogStats data, which can contain literal SQL statements and bound application values from various Vitess workflows such as MoveTables, Reshard, and Online DDL. Because the endpoint does not enforce an acl.DEBUGGING check, an attacker can access the data without authenticating.

Affected Systems

This issue affects Vitess releases 24.0.2 and earlier. All deployments running these versions that expose the vttablet debug HTTP port to any external or remote network are vulnerable. The affected component is the vttablet debug service within the Vitess clustering system.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV, but the lack of authentication makes it trivially exploitable by anyone who can reach the debug port. Attackers can simply issue an HTTP request to the exposed endpoint and obtain internal SQL statements and data, potentially leading to data confidentiality compromise.

Generated by OpenCVE AI on August 18, 2026 at 19:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a vendor patch that adds the missing authorization check, such as upgrading to Vitess 24.0.3 or later.
  • Configure network controls or firewall rules to restrict the vttablet debug HTTP port to trusted hosts only.
  • If an immediate patch is not possible, block public or untrusted access to the debug port and monitor for any suspicious requests to the /debug/vrlog URI.

Generated by OpenCVE AI on August 18, 2026 at 19:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-mhc4-g3wh-cw7m Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
History

Tue, 18 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Vitessio
Vitessio vitess
Vendors & Products Vitessio
Vitessio vitess

Tue, 18 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Description Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows
Title Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Vitessio Vitess
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T18:41:22.307Z

Reserved: 2026-07-23T18:15:14.579Z

Link: CVE-2026-65959

cve-icon Vulnrichment

Updated: 2026-08-18T18:41:18.076Z

cve-icon NVD

Status : Received

Published: 2026-08-18T19:17:00.223

Modified: 2026-08-18T19:17:00.223

Link: CVE-2026-65959

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T19:45:03Z

Weaknesses