Security Bypass in Vitess Database Clustering System

CVE-2026-65959

What is CVE-2026-65959?

A vulnerability in Vitess enables unauthorized access to sensitive data through the /debug/vrlog endpoint. This issue arises because the endpoint does not enforce proper access control, allowing remote attackers with access to the vttablet debug HTTP port to retrieve sensitive VrLogStats data. This data may expose SQL statements and bound application values, potentially compromising the integrity of database operations, including MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows.

References