CVE-2026-65959: Vitess vttablet missing authorization in /debug/vrlog endpoint

CVE-2026-65959 · Severity: medium · CVSS 5.3 · Published 2026-08-18

Vitess vttablet's /debug/vrlog HTTP endpoint streams live database replication data (including raw SQL statements with embedded data values) without checking access permissions. An attacker who can reach the debug port but lacks admin authorization can read sensitive replicated data such as PII, bypassing access controls that operators intentionally configured to protect this information.

Technologies: vitess.io/vitess (Go). Vendors: Go.

Quick answers

Is CVE-2026-65959 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-65959 being exploited in the wild.
How severe is CVE-2026-65959?
Medium severity, with a CVSS score of 5.3, published 18 August 2026.
Which products and versions are affected?
vitess.io/vitess (Go) SEMVER:introduced=0,fixed=0.23.6,introduced=0.24.0-rc1,fixed=0.24.3, SEMVER:introduced=0.24.0-rc1,last_affected=0.24.2; Vitess >= 0.24.0-rc1, <= 0.24.2; <= 0.23.6.
Is there a fix for CVE-2026-65959?
Yes. vitess.io/vitess (Go): upgrade to 0.24.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65959 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-65959?
Check whether you run vitess.io/vitess (Go) or Vitess at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vitess.io/vitess (Go): upgrade to 0.24.3 or later
    go get vitess.io/vitess@v0.24.3

Technical details

The vulnerability is a missing authorization check (CWE-862) in the /debug/vrlog HTTP endpoint handler in go/vt/vttablet/tabletmanager/vreplication/vrlog.go. The vrlogStatsHandler() function streams live VReplication events directly to the HTTP response without calling acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike every other debug endpoint (querylogz, queryz, txlogz, livequeryz, schemaz, debugenv, hotrows) which uniformly perform this check first. The endpoint exposes the literal SQL DML statements (including bound data values) being replicated by MoveTables, Reshard, Materialize, and Online DDL operations. Attack requires only network reachability to the vttablet debug HTTP port; no credentials or user interaction are required. An attacker can stream live application data indefinitely (bounded only by timeout/limit parameters, and repeatable). The fix is a simple 3-line addition of the standard acl.CheckAccessHTTP call, which Vitess maintainers have already applied in commits 4c58cd7, 657662e, and d929225 across supported release branches.

Affected products

  • Vitess Vitess >= 0.24.0-rc1, <= 0.24.2; <= 0.23.6

Identifiers

  • CVE-2026-65959
  • GHSA-mhc4-g3wh-cw7m
  • GO-2026-6356

Timeline

  • 2026-08-18: disclosed: Published to GitHub Advisory Database
  • 2026-07-03: advisory: Published by GitHub (internal review date)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.