CVE-2026-65959: Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.0.2 - Configuration
In vttablet, ensure the handler invoked by the /debug/vrlog endpoint from addHttpEndpoint() (vrlogStatsHandler()) performs acl.CheckAccessHTTP(r, acl.DEBUGGING) before streaming VrLogStats data.
Vitess vttablet (go/vt/vttablet/tabletmanager/vreplication/vrlog.go) acl.CheckAccessHTTP(r, acl.DEBUGGING) = required
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Any deployment where an unauthenticated remote party can reach the vttablet debug HTTP port is exposed. The missing authorization check bypasses the configured debugging ACL specifically for the /debug/vrlog endpoint.
What access does an attacker need to exploit this issue?
An attacker needs only network access to the vttablet debug HTTP port; no credentials, privileges, or user interaction are required. They can request /debug/vrlog and stream VReplication log statistics.
What information could be disclosed?
The exposed data can include literal SQL statements and bound application values generated by MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows. This is an information-disclosure issue; the provided data does not indicate integrity or availability impact.
What can be done if patching is not immediately possible?
Restrict network access to the vttablet debug HTTP port so untrusted remote callers cannot reach it. This limits access to the endpoint while a permanent remediation is applied.
How can I determine whether an instance is affected?
Check whether the affected vttablet instance is version 24.0.2 or earlier and whether its debug HTTP port is reachable by untrusted networks. A reachable /debug/vrlog endpoint can be accessed without the expected debugging ACL enforcement.