—

GO-2026-6356

Missing authorization on vttablet /debug/vrlog in vitess.io/vitess

Quick fix

GO-2026-6356 — vitess.io/vitess: upgrade to the fixed version with the command below.

go get vitess.io/vitess@v0.23.6

Details

The vttablet /debug/vrlog HTTP endpoint streams live VReplication event data, including SQL statements and table row changes, without verifying authorization via acl.CheckAccessHTTP. An unauthenticated actor with network access to the debug endpoint can stream live replicated SQL data.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/vitess.io/vitess

Introduced in: 0Fixed in: 0.23.6

Fixgo get vitess.io/vitess@v0.23.6

References

https://github.com/vitessio/vitess/security/advisories/GHSA-mhc4-g3wh-cw7m[ADVISORY]
https://github.com/vitessio/vitess/pull/20467[FIX]