Description

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T19:17:00.223Z",
  "pubdate": "2026-08-18T19:17:00.223Z",
  "executiveSummary": "A security vulnerability exists in the Vitess database clustering system affecting version 24.0.2 and earlier. The flaw involves an unauthorized access vulnerability within the vttablet debug HTTP port, specifically impacting the /debug/vrlog endpoint.\nThe vulnerability allows remote attackers who can reach the vttablet debug HTTP port to bypass the configured security policy and stream sensitive VrLogStats data. This data includes literal SQL statements and bound application values derived from critical operations such as MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows.\nThe root cause stems from the omission of the mandatory acl.CheckAccessHTTP(r, acl.DEBUGGING) access control check within the vrlogStatsHandler() function when invoked by addHttpEndpoint(). Consequently, sensitive execution telemetry and confidential application data are exposed to unauthorized network entities without requiring authentication.\nThe risk implication is severe, as exposed query strings and bound parameters frequently contain sensitive business logic, personal identifiable information, or credentials. Mitigation requires updating Vitess or properly restricting network access to the vttablet debug HTTP port.",
  "technicalDetails": "The vulnerability resides in the Go codebase of Vitess, specifically within the go/vt/vttablet/tabletmanager/vreplication/vrlog.go file. The function addHttpEndpoint() registers the /debug/vrlog HTTP endpoint, which maps directly to the execution of vrlogStatsHandler().\nUnlike comparable debugging endpoints implemented throughout the Vitess architecture, vrlogStatsHandler() fails to invoke acl.CheckAccessHTTP(r, acl.DEBUGGING). The acl package in Vitess is responsible for enforcing administrative and debugging access control policies. The absence of this validation check bypasses the authentication and authorization mechanisms normally enforced for diagnostic endpoints.\nThe attack flow proceeds as follows: 1. A remote actor identifies the network location and open port of the targeted vttablet debug HTTP service. 2. The actor issues an unauthenticated HTTP request directly to the /debug/vrlog endpoint. 3. Because the endpoint lacks the acl.CheckAccessHTTP(r, acl.DEBUGGING) validation, the handler processes the request immediately. 4. The underlying vrlogStatsHandler() invokes NewVrLogStats().Send() to stream VrLogStats data back to the caller.\nThe payload returned to the unauthorized caller comprises real-time telemetry from replication workflows. This stream includes literal SQL statements and bound application values extracted from active and historical MoveTables, Reshard, Materialize, and vitess-strategy Online DDL operations.\nThe affected component is the vttablet tabletmanager vreplication subsystem in Vitess versions 24.0.2 and earlier. Exploitation requires network reachability to the vttablet debug HTTP port. No user authentication or specific administrative privileges are required by the caller due to the missing access control enforcement.\nThe post-exploitation impact centers on data exfiltration. Attackers gain visibility into internal database operations, query structures, and sensitive parameter values passing through replication streams, potentially exposing database contents and facilitating further targeted attacks."
}