Advisory [GHSA-mhc4-g3wh-cw7m](https://github.com/advisories/GHSA-mhc4-g3wh-cw7m) references a vulnerability in the following Go modules: | Module | | - | | [vitess.io/vitess](https://pkg.go.dev/vitess.io/vitess) | Description: ## Vulnerability Details **File**: `go/vt/vttablet/tabletmanager/vreplication/vrlog.go` ### Summary `vttablet`'s `/debug/vrlog` HTTP endpoint streams live VReplication event data — including the literal SQL DML statements being replicated by MoveTables, Reshard, Materialize, and "vitess"-strategy Online DDL workflows — with no authorization check at all. Every comparable "debugging" HTTP endpoint in vttablet/vtgate (querylogz, queryz, txlogz, livequeryz, schemaz, debugenv, hotrows, tablet_plans, query_stats, query_rules) calls `acl.CheckAccessHTTP(r, acl.DEBUGGING)` before serving data, ... References: - ADVISORY: https://github.com/advisories/GHSA-mhc4-g3wh-cw7m - ADVISORY: https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m - ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2026-65959 - FIX: https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f - FIX: https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094 - FIX: https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb - FIX: https://github.com/vitessio/vitess/pull/20467 Cross references: - vitess.io/vitess appears in 6 other report(s): - data/excluded/GO-2023-1769.yaml (https://github.com/golang/vulndb/issues/1769) EFFECTIVELY_PRIVATE - data/reports/GO-2023-1717.yaml (https://github.com/golang/vulndb/issues/1717) - data/reports/GO-2024-2826.yaml (https://github.com/golang/vulndb/issues/2826) - data/reports/GO-2024-3306.yaml (https://github.com/golang/vulndb/issues/3306) - data/reports/GO-2026-4567.yaml (https://github.com/golang/vulndb/issues/4567) - data/reports/GO-2026-4570.yaml (https://github.com/golang/vulndb/issues/4570) See [doc/quickstart.md](https://github.com/golang/vulndb/blob/master/doc/quickstart.md) for instructions on how to triage this report. ``` id: GO-ID-PENDING modules: - module: vitess.io/vitess non_go_versions: - introduced: TODO (earliest fixed "", vuln range ">= 0.24.0-rc1, <= 0.24.2") vulnerable_at: 0.24.2 summary: |- Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data in vitess.io/vitess cves: - CVE-2026-65959 ghsas: - GHSA-mhc4-g3wh-cw7m references: - advisory: https://github.com/advisories/GHSA-mhc4-g3wh-cw7m - advisory: https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-65959 - fix: https://github.com/vitessio/vitess/commit/4c58cd70edc6b03d61cb65842c342ac08341e64f - fix: https://github.com/vitessio/vitess/commit/657662e78bde1c82df680e9cc43a686d619f8094 - fix: https://github.com/vitessio/vitess/commit/d929225a450027406687d27af8dca45620945ceb - fix: https://github.com/vitessio/vitess/pull/20467 notes: - fix: 'module merge error: could not merge versions of module vitess.io/vitess: invalid or non-canonical semver version (found TODO (earliest fixed "", vuln range ">= 0.24.0-rc1, <= 0.24.2"))' source: id: GHSA-mhc4-g3wh-cw7m created: 2026-09-02T16:02:28.353977575Z review_status: UNREVIEWED ```