{"id":"GO-2026-6356","revision":null,"records":[{"revision":"0bf0dc8504ca4353bc1a45543b9ba70c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-65959","aliases":[],"title":"Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data","description":"Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows","state":0,"publishedAt":"2026-08-18T18:18:46.919+00:00","modifiedAt":"2026-08-18T18:41:22.307+00:00","affected":[{"ecosystem":"Vendor product","name":"vitess","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"vitessio\",\n                    \"product\": \"vitess\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 24.0.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-65959","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-65959","identifiers":["CVE-2026-65959"]},"retained":false,"historicalAffected":[]},{"revision":"875a68c4e65c4c15b1cb17ac99e05be1","observedAt":"2026-11-11T15:08:41.683+00:00","statement":{"source":"euvd","id":"EUVD-2026-61106","aliases":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m"],"title":"Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() witho…","description":"Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":null}],"references":["https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-61106","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 6:18:46 PM","dateUpdated":"Aug 18, 2026, 6:41:22 PM"},"relatedAdvisories":[{"id":"msrc_CVE-2026-65959","title":"Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data","vulnerabilityIds":["CVE-2026-65959"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-61106","identifiers":["EUVD-2026-61106","CVE-2026-65959","GHSA-mhc4-g3wh-cw7m"]},"retained":false,"historicalAffected":[]},{"revision":"c06481bde47948b8a56732d25c208240","observedAt":"2026-10-31T18:05:05.654+00:00","statement":{"source":"nvd","id":"CVE-2026-65959","aliases":[],"title":"Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() witho…","description":"Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows","state":0,"publishedAt":"2026-08-18T19:17:00.223+00:00","modifiedAt":"2026-10-30T18:06:14.397+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb","https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65959","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-862"],"productCriteria":["cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-08-18T19:17:00.223","lastModified":"2026-10-30T18:06:14.397"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-65959","identifiers":["CVE-2026-65959"]},"retained":false,"historicalAffected":[]},{"revision":"f7c42a7e9f4b4b99a02f5af227dc3e79","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-mhc4-g3wh-cw7m","aliases":["CVE-2026-65959","GO-2026-6356"],"title":"Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data","description":"## Vulnerability Details\n\n**File**: `go/vt/vttablet/tabletmanager/vreplication/vrlog.go`\n\n### Summary\n`vttablet`'s `/debug/vrlog` HTTP endpoint streams live VReplication event data — including the literal SQL DML statements being replicated by MoveTables, Reshard, Materialize, and \"vitess\"-strategy Online DDL workflows — with no authorization check at all. Every comparable \"debugging\" HTTP endpoint in vttablet/vtgate (querylogz, queryz, txlogz, livequeryz, schemaz, debugenv, hotrows, tablet_plans, query_stats, query_rules) calls `acl.CheckAccessHTTP(r, acl.DEBUGGING)` before serving data, so that the cluster operator's configured `--security-policy` (e.g. `deny-all`, `read-only`, or a custom plugin) is actually honored. `vrlog.go` is the one exception: it has zero references to the `acl` package.\n\n### Root Cause\n`addHttpEndpoint()` registers `/debug/vrlog` via `servenv.HTTPHandleFunc`, and `vrlogStatsHandler()` immediately starts streaming subscribed `VrLogStats` events to the response writer without first calling `acl.CheckAccessHTTP(r, acl.DEBUGGING)`, unlike every sibling handler in the same family (see e.g. `go/vt/vttablet/tabletserver/querylogz.go`'s `querylogzHandler`, which calls the check first).\n\nThe data streamed is sensitive: `go/vt/vttablet/tabletmanager/vreplication/vplayer.go` calls `NewVrLogStats(...).Send(sql)` / `.Send(event.Statement)` for every row change and statement event flowing through a VReplication stream (vplayer.go:339, 700, 771, 785) — i.e. the literal SQL (including bound data values) being copied/replicated by MoveTables, Reshard, Materialize, and Online DDL.\n\n### Attack Scenario\n1. A cluster operator configures `--security-policy=deny-all` (or `read-only`, or a custom policy) specifically to lock down debugging/admin HTTP endpoints on vttablet, relying on this being uniformly enforced.\n2. An attacker who can reach the vttablet debug HTTP port (common in Kubernetes/Prometheus-scraping deployments where this port is exposed beyond localhost) — but who does NOT have the `DEBUGGING`/admin role the policy requires — sends `GET /debug/vrlog`.\n3. Every other debug endpoint correctly returns `403 Forbidden`. `/debug/vrlog` returns `200 OK` and streams live VReplication event data, including raw SQL DML statements containing application data values, for as long as the attacker keeps the connection open (bounded by `timeout`/`limit` query params, repeatable).\n\n### Impact\nConfidentiality impact: disclosure of live replicated application data (potentially including PII or other sensitive column values) to an unauthorized actor, bypassing an access control the operator explicitly configured. No write/modify capability; this is a read-only information-disclosure / access-control-bypass issue, scoped to the vttablet debug HTTP listener.\n\n### Vulnerable Code\n```go\n// go/vt/vttablet/tabletmanager/vreplication/vrlog.go\nfunc addHttpEndpoint() {\n\tservenv.HTTPHandleFunc(\"/debug/vrlog\", func(w http.ResponseWriter, r *http.Request) {\n\t\tch := vrLogStatsLogger.Subscribe(\"vrlogstats\")\n\t\tdefer vrLogStatsLogger.Unsubscribe(ch)\n\t\tvrlogStatsHandler(ch, w, r)\n\t})\n}\n\nfunc vrlogStatsHandler(ch chan *VrLogStats, w http.ResponseWriter, r *http.Request) {\n\ttimeout, limit := parseTimeoutLimitParams(r)\n\t// no acl.CheckAccessHTTP(r, acl.DEBUGGING) call anywhere in this file\n\t...\n```\n\n### Recommended Fix\n```go\nimport \"vitess.io/vitess/go/acl\"\n\nfunc vrlogStatsHandler(ch chan *VrLogStats, w http.ResponseWriter, r *http.Request) {\n\tif err := acl.CheckAccessHTTP(r, acl.DEBUGGING); err != nil {\n\t\tacl.SendError(w, err)\n\t\treturn\n\t}\n\ttimeout, limit := parseTimeoutLimitParams(r)\n\t...\n```\nThis mirrors the exact pattern already used by `querylogz.go`, `queryz.go`, `txlogz.go`, `livequeryz.go`, `schemaz.go`, `debugenv.go`, and `tx_serializer.go` (hotrows) in the same codebase.\n\n### Verification\nBuilt v24.0.1 from source and wrote a standalone Go test that: (1) activates the real `deny-all` security policy via `acl.RegisterFlags`, (2) registers `/debug/vrlog` via the real, unmodified `vreplication.NewVrLogStats(...)` call path (the same one `vplayer.go` uses for live replication traffic), (3) serves the real `servenv` HTTP mux on a loopback listener, and (4) issues a real `GET /debug/vrlog` while emitting a simulated replicated statement.\n\nResult:\n```\nacl.CheckAccessHTTP(DEBUGGING) under deny-all => err=not allowed: deny-all security-policy enforced\nGET /debug/vrlog under deny-all => status=200 body=\"ROWCHANGE Event\\tINSERT INTO secret_table (ssn) VALUES ('leaked-via-vrlog')\\t2026-06-22T11:01:55\\t147101\\n\"\n```\nThe identical ACL check that protects every sibling endpoint correctly rejected the request, while `/debug/vrlog` returned 200 and streamed the simulated sensitive content — confirming the bypass against real, unmodified v24.0.1 code.\n\nAlso confirmed via the GitHub Contents API that `vrlog.go` has zero references to the `acl` package on `main`, `release-23.0`, and `release-22.0` as well, so all currently supported release lines appear affected.","state":0,"publishedAt":"2026-08-18T20:50:54+00:00","modifiedAt":"2026-09-15T19:10:55.1763788+00:00","affected":[{"ecosystem":"Go","name":"vitess.io/vitess","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.24.0-rc1"},{"kind":"last_affected","version":"0.24.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"vitess.io/vitess","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"0.23.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://nvd.nist.gov/vuln/detail/CVE-2026-65959","https://github.com/vitessio/vitess/pull/20467","https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f","https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094","https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb","https://github.com/vitessio/vitess"],"sourceUrl":"https://github.com/advisories/GHSA-mhc4-g3wh-cw7m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mhc4-g3wh-cw7m","identifiers":["GHSA-mhc4-g3wh-cw7m","CVE-2026-65959","GO-2026-6356"]},"retained":false,"historicalAffected":[]},{"revision":"d1905ab752c94f4798688a85a0779618","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6356","aliases":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m"],"title":"Missing authorization on vttablet /debug/vrlog in vitess.io/vitess","description":"The vttablet /debug/vrlog HTTP endpoint streams live VReplication event data, including SQL statements and table row changes, without verifying authorization via acl.CheckAccessHTTP. An unauthenticated actor with network access to the debug endpoint can stream live replicated SQL data.","state":0,"publishedAt":"2026-09-15T18:39:25+00:00","modifiedAt":"2026-09-15T19:00:16.966589+00:00","affected":[{"ecosystem":"Go","name":"vitess.io/vitess","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.23.6"},{"kind":"introduced","version":"0.24.0-rc1"},{"kind":"fixed","version":"0.24.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m","https://github.com/vitessio/vitess/pull/20467"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6356","license":"OSV · upstream source license applies","key":"osv:GO-2026-6356","identifiers":["GO-2026-6356","CVE-2026-65959","GHSA-mhc4-g3wh-cw7m"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T12:59:11.9732431+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T12:59:11.9732431+00:00","lastSuccessAt":"2026-11-13T12:59:12.1229749+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:12.1229756+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-f139040820e198a7b90c89ade0a85e4d1784f6cdedc33dd35667c553a90ed9b3","complete":true,"records":425359,"lastAttemptAt":"2026-11-13T12:57:12.1370926+00:00","lastSuccessAt":"2026-11-13T12:57:12.0535039+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:57:12.1370926+00:00","snapshotPublishedAt":"2026-11-13T12:35:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8106b486b70c4e0a972457e9bec940ae","complete":false,"records":13795,"lastAttemptAt":"2026-11-13T13:08:46.7498468+00:00","lastSuccessAt":"2026-11-13T13:08:46.746+00:00","error":"412 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T13:08:46.746+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13087,"expectedIdentifiers":13848,"failedIdentifiers":412},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T12:59:11.9732431+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T12:59:11.9732431+00:00","lastSuccessAt":"2026-11-13T12:59:12.1237796+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:12.1237798+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-18b27772e3264b22ab6b919eb23a22fd","complete":true,"records":13795,"lastAttemptAt":"2026-11-13T12:59:14.4637385+00:00","lastSuccessAt":"2026-11-13T12:59:14.459+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:14.459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13848,"expectedIdentifiers":13848,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T12:59:07.8110438+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:07.8110438+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T12:57:12.2985214+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:57:12.2985214+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-ab4ad5f59937c0596645e186474e26d2fffbbe6ecc09983ad71f9a0d88918405","complete":true,"records":3129,"lastAttemptAt":"2026-11-13T12:59:11.9406927+00:00","lastSuccessAt":"2026-11-13T12:59:11.7864534+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:11.9406927+00:00","snapshotPublishedAt":"2026-11-13T12:47:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-7d9437160a3664a4238cadabbe17e78db87dde648ca4c671841d50155dfa5d6c","complete":true,"records":231770,"lastAttemptAt":"2026-11-13T12:59:07.6810383+00:00","lastSuccessAt":"2026-11-13T12:59:06.1905777+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:07.6810383+00:00","snapshotPublishedAt":"2026-11-13T12:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}