CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
Remote attackers can access the vttablet debug endpoint to view sensitive VReplication SQL data and bypass security policies due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65959?
CVE-2026-65959 is a medium-severity missing authorization vulnerability in vitessio vitess, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows
Weakness: CWE-862
Which versions are affected by CVE-2026-65959?
5 open source packages ship an affected version, including vitess.io/vitess.
| Package | Affected | Fixed in |
|---|---|---|
vitess.io/vitess Go | All versions | 0.23.6, 0.24.3 |
vitess.io/vitess Go | All versions to 0.23.6 | None |
vitess.io/vitess Go | All versions to 0.23.6 | None |
vitess.io/vitess Go | From 0.24.0-rc1 to 0.24.2 | None |
vitess.io/vitess Go | From 0.24.0-rc1 to 0.24.2 | None |
How do I fix CVE-2026-65959?
Upgrade vitess.io/vitess to a fixed version for your release line: 0.23.6 or 0.24.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-65959 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65959 exists.
Sources
Also known as AZL-96770, GHSA-mhc4-g3wh-cw7m, GO-2026-6356.