{"id":"GO-2026-6356","summary":"Missing authorization on vttablet /debug/vrlog in vitess.io/vitess","details":"The vttablet /debug/vrlog HTTP endpoint streams live VReplication event data, including SQL statements and table row changes, without verifying authorization via acl.CheckAccessHTTP. An unauthenticated actor with network access to the debug endpoint can stream live replicated SQL data.","aliases":["CVE-2026-65959","GHSA-mhc4-g3wh-cw7m"],"modified":"2026-09-15T19:00:16.966589044Z","published":"2026-09-15T18:39:25Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6356"},"references":[{"type":"ADVISORY","url":"https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m"},{"type":"FIX","url":"https://github.com/vitessio/vitess/pull/20467"}],"affected":[{"package":{"name":"vitess.io/vitess","ecosystem":"Go","purl":"pkg:golang/vitess.io/vitess"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.6"},{"introduced":"0.24.0-rc1"},{"fixed":"0.24.3"}]}],"ecosystem_specific":{"imports":[{"path":"vitess.io/vitess/go/vt/vttablet/tabletmanager/vreplication","symbols":["AddStatusPart","Engine.Close","Engine.Exec","Engine.ExecWithDBA","Engine.Open","Engine.WaitForPos","InsertGenerator.AddRow","MatchTable","NewEngine","NewInsertGenerator","NewReplicaConnector","NewSimpleTestEngine","NewTestEngine","NewVrLogStats","ReplicaConnector.Close","ReplicaConnector.VStream","ReplicatorPlan.MarshalJSON","TablePlan.MarshalJSON","VrLogStats.Send","addHttpEndpoint","controller.Stop","externalConnector.Close","externalConnector.Get","mysqlConnector.VStream","mysqlConnector.VStreamRows","mysqlConnector.VStreamTables","relayLog.Fetch","relayLog.Send","tabletConnector.Open","vcopierCopyTaskState.String","vcopierCopyWorker.Close","vdbClient.AddQueryToTrxBatch","vdbClient.Begin","vdbClient.Commit","vdbClient.CommitTrxQueryBatch","vdbClient.Execute","vdbClient.ExecuteFetch","vdbClient.ExecuteTrxQueryBatch","vdbClient.ExecuteWithRetry","vdbClient.Retry","vdbClient.Rollback","vreplicator.Replicate","vrlogStatsHandler"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6356.json"}}],"schema_version":"1.9.0"}