CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-65959

In Vitess 24.0.2 and earlier, the /debug/vrlog endpoint in vrlog.go calls vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote attacker reaching the vttablet debug HTTP port can stream live VReplication SQL statements and bound application...

CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

EUVD-2026-61106

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-73646 vulnerabilities

Vulnerabilities for packages: langfuse, vitess, jitsucom-jitsu, nextcloud-server...

GO-2026-6000 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, datadog-agent, kubernetes-dns-node-cache-fips, buildkite-agent, buildkite-agent-fips, eks-distro-fips, kubernetes-dns-node-cache, coder-fips, traefik, vitess, traefik-fips, eks-distro, coder...

GO-2026-6000 vulnerabilities

Vulnerabilities for packages: datadog-agent, kubernetes-dns-node-cache, vitess...

GHSA-QWWW-VCR4-C8H2 vulnerabilities

Vulnerabilities for packages: vitess, librechat...

GHSA-QWWW-VCR4-C8H2 vulnerabilities

Vulnerabilities for packages: vitess...

CVE-2026-53667 vulnerabilities

Vulnerabilities for packages: vitess...

GHSA-CHX6-HX7R-MCP5 vulnerabilities

Vulnerabilities for packages: vitess...

GHSA-WRJC-X8RR-H8H6 vulnerabilities

Vulnerabilities for packages: vitess, keycloak...

CVE-2026-53666 vulnerabilities

Vulnerabilities for packages: vitess, keycloak...

CVE-2026-55685 vulnerabilities

Vulnerabilities for packages: vitess...

GHSA-H8FP-F39C-Q6MH vulnerabilities

Vulnerabilities for packages: vitess...

CVE-2026-53669 vulnerabilities

Vulnerabilities for packages: vitess, keycloak...

GHSA-337J-9HXR-RHXG vulnerabilities

Vulnerabilities for packages: vitess, keycloak...

CVE-2026-55685 vulnerabilities

Vulnerabilities for packages: vitess...

GHSA-CHX6-HX7R-MCP5 vulnerabilities

Vulnerabilities for packages: vitess...

CVE-2026-53669 vulnerabilities

Vulnerabilities for packages: keycloak, librechat, vitess...