Vitess
Monthly
Reflected cross-site scripting in the Vitess vttablet and vtcombo /twopcz HTTP debug endpoint allows a remote, unauthenticated attacker (per the supplied CVSS vector, PR:N) to inject script into the response by supplying crafted Action and dtid form values, which twopczHandler writes into a text/html response without HTML escaping. Successful exploitation requires operator interaction - a targeted operator must open the attacker-crafted request in a browser - after which the script runs with the vttablet debug origin and can read same-origin diagnostic endpoints exposing query, transaction, environment, variable, or profiling data present in that deployment. Affected deployments are those running Vitess before 23.0.5 or 24.0.x before 24.0.2 where the debug endpoint is reachable under the default allow-all ACL; no public exploit code was identified at time of analysis and there is no CISA KEV entry, and the supplied 9.8 score overstates impact because the assessed vector requires user interaction and bounds integrity impact to the reflected page content.
Path traversal in Vitess backup manifest handling allows authenticated attackers with access to backup storage to write arbitrary files to any location during restore operations, potentially achieving remote code execution on production MySQL deployments. An attacker can manipulate backup manifests to extract files outside intended directories, gaining unauthorized access to sensitive data and the ability to execute arbitrary commands in the production environment. Patches are available for versions 23.0.3 and 22.0.4.
Command injection in Vitess MySQL clustering system before 23.0.3/22.0.4. Users with read/write access to the backup store can achieve code execution. Patch available.
Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL statements and bound application parameter values to any caller who can reach the debug HTTP port. The `/debug/vrlog` endpoint, registered via `addHttpEndpoint()` in `go/vt/vttablet/tabletmanager/vreplication/vrlog.go`, invokes `vrlogStatsHandler()` without the `acl.CheckAccessHTTP(r, acl.DEBUGGING)` guard applied to every comparable debug endpoint, violating the operator-configured security policy. Critically, the feature is disabled by default since v22 and requires explicit opt-in via `--vreplication-enable-http-log`, which materially limits real-world exposure; no public exploit has been identified and the CVE is not listed in CISA KEV.
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Vitess is a database clustering system for horizontal scaling of MySQL. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Reflected cross-site scripting in the Vitess vttablet and vtcombo /twopcz HTTP debug endpoint allows a remote, unauthenticated attacker (per the supplied CVSS vector, PR:N) to inject script into the response by supplying crafted Action and dtid form values, which twopczHandler writes into a text/html response without HTML escaping. Successful exploitation requires operator interaction - a targeted operator must open the attacker-crafted request in a browser - after which the script runs with the vttablet debug origin and can read same-origin diagnostic endpoints exposing query, transaction, environment, variable, or profiling data present in that deployment. Affected deployments are those running Vitess before 23.0.5 or 24.0.x before 24.0.2 where the debug endpoint is reachable under the default allow-all ACL; no public exploit code was identified at time of analysis and there is no CISA KEV entry, and the supplied 9.8 score overstates impact because the assessed vector requires user interaction and bounds integrity impact to the reflected page content.
Path traversal in Vitess backup manifest handling allows authenticated attackers with access to backup storage to write arbitrary files to any location during restore operations, potentially achieving remote code execution on production MySQL deployments. An attacker can manipulate backup manifests to extract files outside intended directories, gaining unauthorized access to sensitive data and the ability to execute arbitrary commands in the production environment. Patches are available for versions 23.0.3 and 22.0.4.
Command injection in Vitess MySQL clustering system before 23.0.3/22.0.4. Users with read/write access to the backup store can achieve code execution. Patch available.
Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL statements and bound application parameter values to any caller who can reach the debug HTTP port. The `/debug/vrlog` endpoint, registered via `addHttpEndpoint()` in `go/vt/vttablet/tabletmanager/vreplication/vrlog.go`, invokes `vrlogStatsHandler()` without the `acl.CheckAccessHTTP(r, acl.DEBUGGING)` guard applied to every comparable debug endpoint, violating the operator-configured security policy. Critically, the feature is disabled by default since v22 and requires explicit opt-in via `--vreplication-enable-http-log`, which materially limits real-world exposure; no public exploit has been identified and the CVE is not listed in CISA KEV.
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Vitess is a database clustering system for horizontal scaling of MySQL. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.