CVE-2026-65959

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows

• CWE-862

• https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64fPatch
• https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094Patch
• https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945cebPatch
• https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7mVendor Advisory, Patch
• https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7mVendor Advisory, Patch

Published

Aug 18, 2026

Last Modified

Oct 30, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65950A path traversal vulnerability in the ZIP extraction logic o…5.8
• CVE-2026-65951A path traversal vulnerability in the TAR.GZ extraction logi…5.8
• CVE-2026-65952Improper neutralization of special elements used in an OS co…8.5
• CVE-2026-65954PHPCSUtils is a suite of utility functions for use with PHP_…8.6
• CVE-2026-65956KubePi is a Kubernetes multi-cluster management panel. In ve…10
• CVE-2026-65957Helio is an MCP proxy that sits between AI agents and the to…6.9
• CVE-2026-6596A security flaw has been discovered in langflow-ai langflow …7.3
• CVE-2026-65960Tetragon is an eBPF-based security observability and runtime…8.8
• CVE-2026-65965ideon is a self-hosted visual workspace. Prior to version 0.…8.7
• CVE-2026-65967Fider is a feedback portal for feature requests and suggesti…7.1
• CVE-2026-65968ideon is a self-hosted visual workspace. Prior to version 0.…5.3
• CVE-2026-65969OpenImageIO is a toolset for reading, writing, and manipulat…5.5