Vulnerability GO-2026-4567
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
7 months ago
March 10, 2026 at 06:28 PM UTC
Vitess users can gain unauthorized access to production deployment environments in vitess.io/vitess
v0.7.0 - v0.22.3 and v0.23.0 - v0.23.2
v0.7.0 - v0.22.3 and v0.23.0 - v0.23.2
Summary
Vitess users can gain unauthorized access to production deployment environments in vitess.io/vitess
Details
Vitess users with backup storage access can gain unauthorized access to production deployment environments in vitess.io/vitess
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
6 hours ago
Vitess vttablet /twopcz reflected XSS
v0.7.0 - v0.23.4 and v0.24.0 - v0.24.1 GHSA-v75v-6fpf-gvw8
v0.7.0 - v0.23.4 and v0.24.0 - v0.24.1 GHSA-v75v-6fpf-gvw8
Unknown
1 month ago
Missing authorization on vttablet /debug/vrlog in vitess.io/vitess
v0.7.0 - v0.23.5 and v0.24.0-rc1 - v0.24.2 GO-2026-6356
v0.7.0 - v0.23.5 and v0.24.0-rc1 - v0.24.2 GO-2026-6356
Medium Risk
1 month ago
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
v0.7.0 - v0.23.6 and v0.24.0-rc1 - v0.24.2 GHSA-mhc4-g3wh-cw7m
v0.7.0 - v0.23.6 and v0.24.0-rc1 - v0.24.2 GHSA-mhc4-g3wh-cw7m
Unknown
7 months ago
Vitess users with backup storage access can write to arbitrary file paths in vitess.io/vitess
v0.7.0 - v0.22.3 and v0.23.0-rc1 - v0.23.2 GO-2026-4570
v0.7.0 - v0.22.3 and v0.23.0-rc1 - v0.23.2 GO-2026-4570
Critical
7 months ago
Vitess users with backup storage access can write to arbitrary file paths on restore
v0.7.0 - v0.22.3 and v0.23.0-rc1 - v0.23.2 GHSA-r492-hjgh-c9gw
v0.7.0 - v0.22.3 and v0.23.0-rc1 - v0.23.2 GHSA-r492-hjgh-c9gw
Impacted packages
Timeline
Published
7 months ago
March 10, 2026 at 06:28 PM UTC
Fixed (v0.23.3)
7 months ago
February 27, 2026 at 01:42 AM UTC
Fixed (v0.22.4)
7 months ago
February 27, 2026 at 02:52 AM UTC
Last Modified
6 months ago
March 23, 2026 at 04:52 AM UTC