CVE-2026-65959

Name of the Vulnerable Software and Affected Versions Vitess versions prior to 24.0.3

Description The /debug/vrlog endpoint, registered by the addHttpEndpoint() function in go/vt/vttablet/tabletmanager/vreplication/vrlog.go, invokes vrlogStatsHandler() without performing the required access check via acl.CheckAccessHTTP(r, acl.DEBUGGING). This allows a remote caller with access to the vttablet debug HTTP port to bypass security policies and stream VrLogStats data generated by NewVrLogStats().Send(). This data may include literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows.

Recommendations Update Vitess to version 24.0.3 or later. As a temporary mitigation, restrict network access to the vttablet debug HTTP port to prevent unauthorized remote callers from accessing the /debug/vrlog endpoint.