Junglewise Threat Intelligence

CVE-2026-65959: Vitess vttablet missing authorization in /debug/vrlog endpoint

CVE-2026-65959 · Severity: medium · CVSS 5.3 · Published 2026-08-18

Executive brief

Vitess vttablet's /debug/vrlog HTTP endpoint streams live database replication data (including raw SQL statements with embedded data values) without checking access permissions. An attacker who can reach the debug port but lacks admin authorization can read sensitive replicated data such as PII, bypassing access controls that operators intentionally configured to protect this information.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the /debug/vrlog HTTP endpoint handler in go/vt/vttablet/tabletmanager/vreplication/vrlog.go. The vrlogStatsHandler() function streams live VReplication events directly to the HTTP response without calling acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike every other debug endpoint (querylogz, queryz, txlogz, livequeryz, schemaz, debugenv, hotrows) which uniformly perform this check first. The endpoint exposes the literal SQL DML statements (including bound data values) being replicated by MoveTables, Reshard, Materialize, and Online DDL operations. Attack requires only network reachability to the vttablet debug HTTP port; no credentials or user interaction are required. An attacker can stream live application data indefinitely (bounded only by timeout/limit parameters, and repeatable). The fix is a simple 3-line addition of the standard acl.CheckAccessHTTP call, which Vitess maintainers have already applied in commits 4c58cd7, 657662e, and d929225 across supported release branches.

Affected products

  • Vitess Vitess >= 0.24.0-rc1, <= 0.24.2; <= 0.23.6

Timeline

  • 2026-08-18: disclosed: Published to GitHub Advisory Database
  • 2026-07-03: advisory: Published by GitHub (internal review date)

References