CVE-2026-65959

Executive Summary

CVE-2026-65959 is an authorization bypass vulnerability in Vitess, a database clustering system for MySQL horizontal scaling, affecting versions 24.0.2 and earlier. The flaw exists in the /debug/vrlog HTTP endpoint, which fails to enforce access control checks that are standard on comparable debug endpoints, allowing any remote caller who can reach the vttablet debug HTTP port to stream sensitive replication and workflow data — including literal SQL statements and bound application parameters. With a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the vulnerability requires no authentication and no user interaction, making it trivially exploitable in deployments where the debug port is exposed beyond trusted administrative networks.

Technical Analysis

The vulnerability resides in the Vitess vttablet component, specifically in the go/vt/vttablet/tabletmanager/vreplication/vrlog.go file. The addHttpEndpoint() function registers the /debug/vrlog endpoint, which subsequently invokes vrlogStatsHandler(). Critically, this handler is registered WITHOUT the acl.CheckAccessHTTP(r, acl.DEBUGGING) call that other comparable debug endpoints in the same codebase employ. This omission constitutes a missing authorization check (CWE-862).

The access control model for Vitess debug endpoints is designed around the acl.DEBUGGING permission level. When properly applied (as in other /debug/* endpoints), this check evaluates whether the requesting entity is permitted to access debugging functionality based on the configured security policy. The absence of this check on /debug/vrlog means the endpoint is effectively open to any caller who has network reachability to the vttablet HTTP debug listener.

The data exposed originates from NewVrLogStats().Send(), which streams VrLogStats data. This data captures vreplication workflow state and activity. Vreplication is the core data movement engine in Vitess, powering several critical features:

• MoveTables: Migrating tables between keyspaces or shards
• Reshard: Rebalancing shards by splitting/merging shard ranges
• Materialize: Continuously syncing tables based on queries
• Online DDL (vitess-strategy): Schema changes executed in the background without blocking table access

Crucially, the VrLogStats stream includes literal SQL statements and bound application values from these workflows. Bound values are the parameterized inputs (actual runtime values) that applications pass to prepared statements. Exposure of these values constitutes sensitive data leakage — an attacker could mine this stream for credentials, personal identifiable information (PII), financial records, authentication tokens, or any other values that applications routinely embed in SQL queries.

The attack surface consists of the vttablet debug HTTP port (default 15100 for vttablet gRPC/HTTP endpoints, though the exact port is deployment-configurable). The reachability requirement is unconditional: the attacker needs no valid session, no API key, no network position other than TCP/IP connectivity to the port. The CVSS vector confirms this with PR:N (no privileges required), UI:N (no user interaction), and AC:L (no special conditions or race required).

The endpoint streams data continuously, meaning an attacker who connects can passively observe ongoing workflow activity in real time. This is distinct from a snapshot-style leak — the attacker receives a live feed of sensitive query traffic as long as vreplication workflows remain active.

Exploitation Scenarios

No public proof-of-concept exists for this vulnerability; the attack chain described below is inferred from the vulnerability class and the technical details disclosed in the NVD description.

Stage 1 — Reconnaissance and Target Identification: An attacker begins by scanning for exposed Vitess vttablet debug HTTP ports. Services can be identified via banner grabbing, HTTP response headers, or by probing known vttablet path patterns. Network scanning of cloud provider ranges, or internet-wide searches via Shodan/Censys using characteristic attributes of Vitess web servers, would reveal candidate targets. The absence of authentication on the endpoint is the key discriminating factor the attacker verifies.

Stage 2 — Endpoint Validation: The attacker issues an HTTP GET request to http://<target>:<port>/debug/vrlog. Because no acl.CheckAccessHTTP(r, acl.DEBUGGING) is performed, the server responds with HTTP 200 and begins streaming VrLogStats data. A crafted request with appropriate HTTP method and headers is sufficient; no session tokens, cookies, or credentials are needed.

Stage 3 — Data Exfiltration: The attacker maintains the connection open to receive a continuous stream of VrLogStats data generated by NewVrLogStats().Send(). This stream contains literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows. The attacker can either capture the raw stream for offline analysis or parse it in real time to extract sensitive values as they pass through vreplication pipelines.

Stage 4 — Post-Exploitation Impact: The exfiltrated SQL statements and bound parameters expose application data in motion. This may include user credentials (e.g., login/password pairs in INSERT or UPDATE statements), API keys, session tokens, financial transaction details, or personal data protected by regulations (GDPR, HIPAA, PCI-DSS). Additionally, the SQL statements themselves reveal the application's data model, table schemas, naming conventions, and business logic — intelligence that materially aids subsequent targeted attacks against the application layer or database layer.

Impact Assessment

The business impact of CVE-2026-65959 is driven entirely by data confidentiality loss. The CVSS subscores highlight the permissive conditions: Attack Vector: Network — exploitable remotely; Attack Complexity: Low — no race conditions or special configuration required; Privileges Required: None; User Interaction: None; Scope: Unchanged. The impact subscore for Confidentiality is Low (C:L), reflecting that the exposed data is limited to vreplication workflow logs rather than full database contents.

Nevertheless, the severity should not be understated in real-world deployments. Vitess is deployed in performance-critical cloud-native environments managing production databases. The data flowing through vreplication workflows is disproportionately high-value: it is live transactional data being moved, rematerialized, or resharded — often inclusive of the most actively used records. A failure to restrict access to this debug endpoint means that any network-adjacent attacker (e.g., a compromised container in the same Kubernetes cluster, a malicious tenant on shared infrastructure, or an unauthenticated internet attacker if the port is exposed) can harvest credentials and sensitive records.

The affected systems are any Vitess vttablet instances running version 24.0.2 or earlier. The blast radius encompasses all workflows managed by the affected vttablet process, including cross-keyspace operations (MoveTables), sharding operations (Reshard), continuous synchronization (Materialize), and non-blocking schema changes (Online DDL via vitess-strategy). A single exposed vttablet can leak data for multiple keyspaces and all application databases served by that tablet.

The vulnerability requires no chaining with other flaws to be effective. Its network-exploitable, unauthenticated nature makes it practical for low-skill attackers to operationalize, even in the absence of a public PoC. The greatest risk intensifies in multi-tenant or zero-trust environments where the debug port may be inadvertently exposed without compensating network controls.

Detection Guidance

Sigma Rule

title: Vitess Debug VRLog Endpoint Access
id: 9f3bd1ae-2c68-4e2d-9f87-01a4d5b77c10
status: experimental
description: Detects HTTP requests to the Vitess /debug/vrlog endpoint, which leaks SQL statements and bound values due to missing ACL check (CVE-2026-65959)
author: Valters IT Security Research
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'GET'
    c-uri|contains: '/debug/vrlog'
  condition: selection
fields:
  - c-uri
  - c-useragent
  - src_ip
  - cs-method
falsepositives:
  - Legitimate debugging by authorized administrators
  - Monitoring tools that periodically check endpoint availability
level: medium
tags:
  - attack.t1190
  - cve.2026-65959
  - cwe.862

YARA Rule

rule vitess_vrlog_exploit_traffic
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects HTTP responses from Vitess /debug/vrlog endpoint leaking VrLogStats data"
        cve = "CVE-2026-65959"
        reference = "NVD: CVE-2026-65959"
        date = "2026-01-01"
        score = 60
    strings:
        $endpoint = "/debug/vrlog" ascii nocase
        $vrlog_marker = "VrLogStats" ascii nocase
        $vreplication_marker = "vreplication" ascii nocase
        $sql_marker_1 = "SELECT" ascii
        $sql_marker_2 = "INSERT" ascii
        $sql_marker_3 = "UPDATE" ascii
        $ddl_marker = "MoveTables" ascii nocase
    condition:
        $endpoint at 0 or
        ($vrlog_marker and $vreplication_marker and 2 of ($sql_marker_*)) or
        ($vrlog_marker and $ddl_marker)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET POLICY Vitess /debug/vrlog Unauthenticated Access Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/debug/vrlog"; nocase; reference:cve,2026-65959; classtype:attempted-recon; sid:99850001; rev:1;)

Elastic Detection

any where process.name == "vttablet" and http_request.method == "GET" and http_request.uri == "/debug/vrlog"

Splunk SPL Query

index=* sourcetype=*access*
| where match(uri, "(?i)/debug/vrlog")
| stats count by src_ip, uri, src_port, dest_ip, dest_port, useragent
| where count > 1
| table _time, src_ip, dest_ip, dest_port, uri, useragent, count
| sort - _time

Wazuh OSSEC Rule

<group name="vitess,">
  <rule id="100501" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/debug/vrlog</field>
    <description>Vitess /debug/vrlog endpoint accessed without authentication (CVE-2026-65959)</description>
    <group>access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor patch exists in any tracked source. Affected versions: 24.0.2 and earlier.

1) Immediate Mitigations:

• Immediately restrict network access to the vttablet debug HTTP port using firewall rules, security groups, or network policies. Permit connections only from trusted administrative IP ranges or jump hosts.
• If the debug port does not need to be externally reachable at all, disable it or bind it to loopback (127.0.0.1) only.
• In Kubernetes environments, apply NetworkPolicies that deny ingress to vttablet pods' debug ports from anything other than allowed management workloads.
• Monitor access logs for any request to /debug/vrlog — investigate both legitimate and potentially malicious access.

2) Patch/Upgrade Steps:

• No patch is available at the time of writing. Monitor the Vitess GitHub repository and the official Vitess security advisory feed for the release that addresses CVE-2026-65959.
• When the patched version is released, upgrade vttablet components to the fixed version. Test the upgrade in a staging environment that replicates your production vreplication workflows before deploying to production.
• Verify the patched version enforces acl.CheckAccessHTTP(r, acl.DEBUGGING) on /debug/vrlog and all other debug endpoints before rolling out.

3) Long-Term Hardening:

• Conduct a review of all debug and diagnostic HTTP endpoints exposed by vttablet and other infrastructure components; inventory what data they expose and whether permissive configurations are justified.
• Implement a zero-trust network posture where debug/administrative interfaces are never exposed to broad network segments, including internal networks, without explicit need.
• Establish baseline monitoring of all HTTP endpoints on database infrastructure. Any request to debug paths from unexpected source IPs should trigger alerts.
• Ensure that vreplication workflow logs and any diagnostic data are treated as sensitive; apply appropriate data retention policies and integrate their logs into enterprise SIEM for correlation.

References

1. NVD Entry — CVE-2026-65959: https://nvd.nist.gov/vuln/detail/CVE-2026-65959
2. Vitess GitHub Repository (source code reference — go/vt/vttablet/tabletmanager/vreplication/vrlog.go): https://github.com/vitessio/vitess
3. Vitess Official Documentation on vreplication: https://vitess.io/docs/user-guides/vreplication/
4. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
5. MITRE ATT&CK — T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Known threat actor campaigns: None reported. No exploit-in-the-wild evidence at the time of writing. CISA KEV status: NOT listed. EPSS score: not yet scored by FIRST.org.