Executive brief
Vitess users can gain unauthorized access to production deployment environments in vitess.io/vitess
Affected products
- Go vitess.io/vitess
Junglewise Threat Intelligence
CVE-2026-27965: GO-2026-4567 - Vitess users can gain unauthorized access to production deployment environments in vitess.io/vitess
CVE-2026-27965 · Severity: medium · CVSS 4 · Published 2026-03-10
Technologies: vitess.io/vitess (Go). Vendors: Go.
Related threats
- Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHt
- GO-2026-4570 - Vitess users with backup storage access can write to arbitrary file paths in vitess.io/vitess
- GO-2024-3306 - Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess
- GO-2024-2826 - Denial of service attack by triggering unbounded memory usage in vitess.io/vitess
- VTAdmin users that can create shards can deny access to other functions