CVE-2026-65959
Received Received - Intake

VrLog Data Exposure in Vitess via Debug Endpoint

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-65959
EUVD
EUVD-2026-61106

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vitess vitess 24.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65959 is a vulnerability in Vitess where the /debug/vrlog endpoint lacks proper authorization checks. This allows remote attackers with access to the vttablet debug HTTP port to stream sensitive SQL data, including bound application values and literal SQL statements from MoveTables, Reshard, Materialize, and Online DDL workflows without authentication.

Detection Guidance

Check if the /debug/vrlog endpoint is accessible on vttablet debug ports. Use curl to test the endpoint: curl http://<vttablet-ip>:<debug-port>/debug/vrlog. If it returns SQL data without authentication, the system is vulnerable.

Impact Analysis

This vulnerability exposes confidential data such as SQL statements and application values to unauthorized users. Attackers could retrieve sensitive information like PII, potentially leading to data breaches, compliance violations, or further exploitation of the system.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and health data without authorization. It breaches confidentiality requirements, potentially leading to regulatory fines, legal liabilities, and reputational damage due to unauthorized data access.

Mitigation Strategies

Upgrade Vitess to version 24.0.3 or later. Remove the --vreplication-enable-http-log flag from VTTablet startup arguments if present. Ensure the --security-policy flag is properly configured to restrict access to debug endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart