Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vitess.io/vitess | go | >= 0.24.0-rc1, <= 0.24.2 | |
| vitess.io/vitess | go | <= 0.23.6 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-65959, describes a missing authorization issue on the /debug/vrlog HTTP endpoint in Vitess. Specifically, the addHttpEndpoint() function in go/vt/vttablet/tabletmanager/vreplication/vrlog.go registered this endpoint, and the vrlogStatsHandler() function served its content, both without the required acl.CheckAccessHTTP authorization check. This allowed remote callers to bypass security policies and stream sensitive VrLogStats data, including SQL statements and application values.
The provided security patches (commits 4c58cd70edc6b03d61cb65842c342ac08341e64f, 657662e78bde1c82df680e9cc43a686d619f8094, d929225a450027406687d27af8dca45620945ceb) address this vulnerability by completely removing the vrlog.go file and all its associated functionality. This direct removal confirms that addHttpEndpoint and vrlogStatsHandler were the core vulnerable functions responsible for the unauthorized exposure.
Additionally, the vplayer.go file shows the removal of calls to VrLogStats.Send() which were conditional on EnableHttpLog. This indicates that VrLogStats.Send() was the method used to push the sensitive data (SQL statements, row changes, etc.) into the log stream that was then exposed. Therefore, while VrLogStats.Send() doesn't directly cause the authorization bypass, it's integral to the sensitive data flow that the vulnerability exploits.
vreplication.addHttpEndpointgo/vt/vttablet/tabletmanager/vreplication/vrlog.go
vreplication.vrlogStatsHandlergo/vt/vttablet/tabletmanager/vreplication/vrlog.go
vreplication.VrLogStats.Sendgo/vt/vttablet/tabletmanager/vreplication/vplayer.go