CVE-2026-65959: Vitess Information Disclosure Vulnerability

CVE-2026-65959 Overview

CVE-2026-65959 is a missing authorization vulnerability [CWE-862] in Vitess, an open-source database clustering system for horizontal scaling of MySQL. Versions 24.0.2 and earlier expose the /debug/vrlog HTTP endpoint on vttablet without invoking acl.CheckAccessHTTP(r, acl.DEBUGGING). A remote caller who can reach the tablet debug HTTP port bypasses the configured security policy and streams VrLogStats data. The exposed data includes literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows.

Critical Impact
Unauthenticated network attackers with reachability to the vttablet debug port can read replicated SQL statements and application data values in transit through VReplication workflows.

Affected Products

Vitess versions 24.0.2 and earlier
Vitess vttablet component exposing /debug/vrlog
Vitess vtcombo component exposing /debug/vrlog

Discovery Timeline

2026-08-18 - CVE-2026-65959 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-65959

Vulnerability Analysis

The vulnerability resides in go/vt/vttablet/tabletmanager/vreplication/vrlog.go. The addHttpEndpoint() function registers the /debug/vrlog route and dispatches to vrlogStatsHandler() without the standard ACL check applied to comparable debug endpoints. Other debug routes in Vitess call acl.CheckAccessHTTP(r, acl.DEBUGGING) before returning sensitive telemetry. The omission allows any client with network access to the debug HTTP listener to stream VrLogStats events produced by NewVrLogStats().Send().

The streamed payload contains literal SQL statements executed by VReplication and their bound parameter values. Data flowing through MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows is disclosed in cleartext to any observer of the endpoint.

Root Cause

The root cause is a missing authorization check on an HTTP debug handler [CWE-862]. Vitess ships with an ACL model gated through acl.CheckAccessHTTP, but the /debug/vrlog handler was registered without that guard, breaking the security policy contract. The feature was internal and undocumented, and the upstream fix removes the --vreplication-enable-http-log flag and the endpoint entirely.

Attack Vector

Exploitation requires network reachability to the vttablet or vtcombo debug HTTP port. No authentication, user interaction, or privileges are required. The attacker issues an HTTP request to /debug/vrlog and receives a live stream of VrLogStats records. Because SQL text and bound values are logged verbatim, sensitive application data traversing active VReplication workflows can be captured passively.

text

// Patch excerpt: removal of --vreplication-enable-http-log flag from vttablet
-      --vreplication-enable-http-log                                     Enable the /debug/vrlog HTTP endpoint, which will produce a log of the events replicated on primary tablets in the target keyspace by all VReplication workflows that are in the running/replicating phase.

Source: Vitess commit 4c58cd7

Detection Methods for CVE-2026-65959

Indicators of Compromise

HTTP GET requests to /debug/vrlog on vttablet or vtcombo debug ports from unexpected source addresses.
Long-lived streaming connections to the debug HTTP listener that persist beyond typical operator sessions.
Presence of the --vreplication-enable-http-log startup flag on tablets running affected releases.

Detection Strategies

Audit tablet process arguments for --vreplication-enable-http-log=true and cross-reference against your inventory of authorized diagnostic hosts.
Correlate reverse-proxy or ingress logs for requests matching path /debug/vrlog against Vitess control-plane source IP allowlists.
Alert when the /debug/vrlog endpoint returns HTTP 200 to any client outside the operator management network.

Monitoring Recommendations

Continuously monitor vttablet HTTP access logs and forward them to a central analytics platform for anomaly detection.
Track outbound data volume from tablet debug ports; sustained streaming to non-operator hosts indicates active exfiltration.
Baseline expected debug endpoint consumers and generate alerts on deviation from that baseline.

How to Mitigate CVE-2026-65959

Immediate Actions Required

Upgrade Vitess to the patched releases that remove the /debug/vrlog endpoint and the --vreplication-enable-http-log flag.
Restrict network access to vttablet and vtcombo debug HTTP ports to trusted operator networks only.
Review historical access logs for prior connections to /debug/vrlog from unexpected clients.

Patch Information

The Vitess maintainers removed the internal, undocumented VRLog feature entirely. See the fix commits 4c58cd7 (release-24.0), 657662e (main), and d929225 (release-23.0), plus the GitHub Security Advisory GHSA-mhc4-g3wh-cw7m.

Workarounds

Do not set --vreplication-enable-http-log on any tablet until upgraded; the flag activates the vulnerable endpoint.
Place vttablet debug ports behind a firewall or service mesh policy that denies traffic from application and public networks.
Front the debug HTTP listener with an authenticating reverse proxy that enforces mTLS or an equivalent identity check.

bash

# Example: firewall the vttablet debug HTTP port to operator subnet only
iptables -A INPUT -p tcp --dport 15100 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 15100 -j DROP

# Ensure the vulnerable flag is not present in tablet startup arguments
ps -ef | grep vttablet | grep -- '--vreplication-enable-http-log' && echo 'REMOVE FLAG'