Vitess
Monthly
Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL statements and bound application parameter values to any caller who can reach the debug HTTP port. The `/debug/vrlog` endpoint, registered via `addHttpEndpoint()` in `go/vt/vttablet/tabletmanager/vreplication/vrlog.go`, invokes `vrlogStatsHandler()` without the `acl.CheckAccessHTTP(r, acl.DEBUGGING)` guard applied to every comparable debug endpoint, violating the operator-configured security policy. Critically, the feature is disabled by default since v22 and requires explicit opt-in via `--vreplication-enable-http-log`, which materially limits real-world exposure; no public exploit has been identified and the CVE is not listed in CISA KEV.
Path traversal in Vitess backup manifest handling allows authenticated attackers with access to backup storage to write arbitrary files to any location during restore operations, potentially achieving remote code execution on production MySQL deployments. An attacker can manipulate backup manifests to extract files outside intended directories, gaining unauthorized access to sensitive data and the ability to execute arbitrary commands in the production environment. Patches are available for versions 23.0.3 and 22.0.4.
Command injection in Vitess MySQL clustering system before 23.0.3/22.0.4. Users with read/write access to the backup store can achieve code execution. Patch available.
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Vitess is a database clustering system for horizontal scaling of MySQL. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL statements and bound application parameter values to any caller who can reach the debug HTTP port. The `/debug/vrlog` endpoint, registered via `addHttpEndpoint()` in `go/vt/vttablet/tabletmanager/vreplication/vrlog.go`, invokes `vrlogStatsHandler()` without the `acl.CheckAccessHTTP(r, acl.DEBUGGING)` guard applied to every comparable debug endpoint, violating the operator-configured security policy. Critically, the feature is disabled by default since v22 and requires explicit opt-in via `--vreplication-enable-http-log`, which materially limits real-world exposure; no public exploit has been identified and the CVE is not listed in CISA KEV.
Path traversal in Vitess backup manifest handling allows authenticated attackers with access to backup storage to write arbitrary files to any location during restore operations, potentially achieving remote code execution on production MySQL deployments. An attacker can manipulate backup manifests to extract files outside intended directories, gaining unauthorized access to sensitive data and the ability to execute arbitrary commands in the production environment. Patches are available for versions 23.0.3 and 22.0.4.
Command injection in Vitess MySQL clustering system before 23.0.3/22.0.4. Users with read/write access to the backup store can achieve code execution. Patch available.
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Vitess is a database clustering system for horizontal scaling of MySQL. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.