CVE-2026-65959

medium

Vitess is a database clustering system for horizontal scaling of MySQL.

Vendor / product: Linuxfoundation — vitess

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows

CVSS

5.3

5.3 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-08-18 19:17

Modified: 2026-10-30 18:06

NVD status: Analyzed

Last synced 3 days ago

Verified against the source API 2026-10-30 18:18 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linuxfoundation / vitess <24.0.2

Weakness classification (CWE)

CWE-862

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m

Patch / mitigation: https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f

Patch / mitigation: https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094

Patch / mitigation: https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb

Patch / mitigation: https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m

References

https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f security-advisories@github.com
https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094 security-advisories@github.com
https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb security-advisories@github.com
https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m security-advisories@github.com
https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-10-30 18:18 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-65959

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs