CVE-2026-65959

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65959
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65959.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65959
Aliases
Downstream
Related
Published
2026-08-18T18:18:46Z
Modified
2026-09-04T09:55:53Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
Details

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65959.json"
}
References

Affected packages

Git / github.com/vitessio/vitess

Affected ranges

Type
GIT
Repo
https://github.com/vitessio/vitess
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4c58cd70edc6b03d61cb65842c342ac08341e64f
Fixed
657662e78bde1c82df680e9cc43a686d619f8094
Fixed
d929225a450027406687d27af8dca45620945ceb
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "24.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.23.0
v0.23.0-rc1
v0.23.0-rc2
v0.23.1
v0.23.2
v0.23.3
v0.23.4
v0.23.5
v0.24.0
v0.24.0-rc1
v0.24.1
v0.24.2
v10.*
v10.0.0-rc1
v10.0.0-rc1-mysql80
v2.*
v2.0.0-alpha2
v2.0.0-alpha4
v2.0.0-alpha5
v2.0.0-beta.2
v2.0.0-rc.1
v2.0.0-rc.2
v2.1.0-alpha.1
v2.2
v2.2-alpha
v2.2.0-rc.1
v23.*
v23.0.0
v23.0.0-rc1
v23.0.0-rc2
v23.0.1
v23.0.2
v23.0.3
v23.0.4
v23.0.5
v24.*
v24.0.0
v24.0.0-rc1
v24.0.1
v24.0.2
v3.*
v3.0
v3.0.0-rc.1
v3.0.0-rc.2
v3.0.0-rc.3
v5.*
v5.0.0
v5.0.1
v6.*
v6.0.0-rc.1
v7.*
v7.0.0-beta
v8.*
v8.0.0-rc1
v9.*
v9.0.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65959.json"