PkgSeer

Vulnerability GO-2026-6356

Unknown

4 hours ago

Missing authorization on vttablet /debug/vrlog in vitess.io/vitess

v0.7.0 - v0.23.5

Summary

Missing authorization on vttablet /debug/vrlog in vitess.io/vitess

Details

The vttablet /debug/vrlog HTTP endpoint streams live VReplication event data, including SQL statements and table row changes, without verifying authorization via acl.CheckAccessHTTP. An unauthenticated actor with network access to the debug endpoint can stream live replicated SQL data.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

v0.7.0 - v0.24.2 GHSA-mhc4-g3wh-cw7m

Vitess users can gain unauthorized access to production deployment environments in vitess.io/vitess

v0.7.0 - v0.22.3 GO-2026-4567

Vitess users with backup storage access can write to arbitrary file paths in vitess.io/vitess

v0.7.0 - v0.22.3 GO-2026-4570

Vitess users with backup storage access can write to arbitrary file paths on restore

v0.7.0 - v0.22.3 and v0.23.0-rc1 - v0.23.2 GHSA-r492-hjgh-c9gw

Vitess users with backup storage access can gain unauthorized access to production deployment environments

v0.7.0 - v0.23.2 GHSA-8g8j-r87h-p36x

View all vulnerabilities for these packages

Impacted packages

vitess.io/vitess

Timeline

Published

4 hours ago

Last Modified

4 hours ago