Skip to main content

Vitess CVE-2026-65959

| EUVDEUVD-2026-61106 MEDIUM
Missing Authorization (CWE-862)
2026-08-18 GitHub_M GHSA-mhc4-g3wh-cw7m
Authentication Bypass Vitess Suse
5.3
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
5.3 MEDIUM

PR:N is correct because the bug IS the absent auth check; the non-default flag is a deployment prerequisite, not an attacker privilege.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 18, 2026 - 18:51 vuln.today
Analysis Generated
Aug 18, 2026 - 18:51 vuln.today

DescriptionCVE.org

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows

AnalysisAI

Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL statements and bound application parameter values to any caller who can reach the debug HTTP port. The /debug/vrlog endpoint, registered via addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go, invokes vrlogStatsHandler() without the acl.CheckAccessHTTP(r, acl.DEBUGGING) guard applied to every comparable debug endpoint, violating the operator-configured security policy. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vttablet process must have been started with the `--vreplication-enable-http-log` flag explicitly set; this flag defaults to false and has been off by default since v22, so operators must have consciously opted in. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately represents the network-reachable, no-auth-required nature of the bug when the endpoint is active. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary fix is upgrading to Vitess v24.0.3, which removes the `/debug/vrlog` endpoint entirely and makes `--vreplication-enable-http-log` a deprecated no-op (see https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f and the advisory at https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vitess

View all
CVE-2026-27965 CRITICAL
9.9 Feb 26

Command injection in Vitess MySQL clustering system before 23.0.3/22.0.4. Users with read/write access to the backup sto
CVE-2026-27969 HIGH
8.8 Feb 26

Path traversal in Vitess backup manifest handling allows authenticated attackers with access to backup storage to write

CVE-2023-29195 MEDIUM POC
4.3 May 11

Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Rated medium severi
CVE-2023-29194 LOW
2.7 Apr 14

Vitess is a database clustering system for horizontal scaling of MySQL. Rated low severity (CVSS 2.7), this vulnerabilit

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Manager Client Tools 15 Affected
SUSE Manager Client Tools for SLE 15 Affected
SUSE Multi-Linux Manager Client Tools for SLE 15 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP4 Affected

Share

CVE-2026-65959 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy