Vitess CVE-2026-65959

The vttablet process must have been started with the --vreplication-enable-http-log flag explicitly set; this flag defaults to false and has been off by default since v22, so operators must have consciously opted in. At least one VReplication workflow (MoveTables, Reshard, Materialize, or vitess-strategy Online DDL) must be in the running/replicating phase to produce log entries worth capturing. The attacker must have TCP connectivity to the vttablet debug HTTP port, which in well-architected deployments is firewalled from untrusted networks. No authentication, no special headers, and no prior session state are required beyond network reachability. Exploitation is limited by: the non-default flag requirement, the need for an active replication workflow, and the typical practice of isolating the vttablet debug port to internal management networks.

The NVD CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately represents the network-reachable, no-auth-required nature of the bug when the endpoint is active. However, the real-world risk is substantially lower than the raw vector suggests: the feature has been disabled by default since v22 and must be explicitly started with --vreplication-enable-http-log. Only operators who consciously opted into this flag are exposed, dramatically narrowing the affected population. The confidentiality impact is genuine - SQL statements with bound values can reveal application schema, data patterns, and potentially sensitive field values - but integrity and availability are unaffected. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, no public proof-of-concept has been identified, and exploitation requires network access to the vttablet debug port, which is typically not internet-exposed in production deployments. Overall this is a real confidentiality concern for the small subset of operators who enabled the flag, but not a broad emergency.

An attacker with network access to a vttablet instance whose operator enabled --vreplication-enable-http-log sends a simple HTTP GET to http://<vttablet-host>:<debug-port>/debug/vrlog. Because the ACL guard is absent, the server streams a continuous feed of VrLogStats records containing literal SQL INSERT/UPDATE/DELETE statements and their bound parameter values from active MoveTables or Reshard workflows, potentially exposing application data, schema structure, and sensitive column values without any credentials.