CVE-2026-65959
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vitess version 24.0.2 and earlier has a vulnerability in the /debug/vrlog endpoint that does not check ACL permissions (missing acl.CheckAccessHTTP). A remote attacker with access to the vttablet debug HTTP port can bypass the security policy and stream VrLogStats data, including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and Online DDL workflows.
Risk Assessment
An attacker could gain access to sensitive SQL query data and application values, potentially leading to information disclosure and confidentiality breaches.
Recommendation
Upgrade Vitess to a patched version or restrict access to the vttablet debug port to trusted networks only.
Original NVD description (English source)
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows