VDB
CVE-2026-65959
CVE-2026-65959
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published August 18, 2026
Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vitessio | vitess | <= 24.0.2 |
| wolfi | vitess-24 | 0, 0 |
| chainguard | vitess-24 | 0, 0 |
| wolfi | vitess-23 | 0 |
| vitessio | vitess | <= 24.0.2 |
| chainguard | vitess-23 | 0 |
| vitess.io | vitess | 0, 0.24.0-rc1 |
Timeline
- Aug 18, 2026 CVE Published
- Aug 20, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Aug 29, 2026 EPSS Score
- Sep 2, 2026 EPSS Score
- Sep 3, 2026 Security Advisory
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 19, 2026 EPSS Score
References
- https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m x_refsource_CONFIRM
- https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f x_refsource_MISC
- https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094 x_refsource_MISC
- https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-65959 advisory
- https://github.com/advisories/GHSA-mhc4-g3wh-cw7m advisory
- https://github.com/vitessio/vitess/pull/20467 patch