vitess
v24.0.5Vitess is a database clustering system for horizontal scaling of MySQL.
- Maintenance
- Active429 commits in 3 months · bus factor 6
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 29 advisories2 critical, 17 high, 10 medium · Scorecard 8.1/10
- Supported versions
- 1 line supportednewest 24 · 11 ended
21.4k stars · 2.4k forks · 1.1k open issues · last release 1 month ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 29 most recent advisories published by the maintainers: 2 critical, 17 high, 10 medium. Check the patched version against the one you run.
- highGHSA-xf67-9r78-xv82Oct 13, 2026Vitess is vulnerable to SQL injection via unvalidated HEXNUM/HEXVAL/BITNUM, over-long DECIMAL and non-finite FLOAT bind variables in the VTGate API
- Affected
- >= 0.24.0, < 0.24.5; < 0.23.8; >= 24.0.0, < 24.0.5; < 23.0.8
- Patched in
- 0.24.5; 0.23.8; 24.0.5; 23.0.8
- highGHSA-j8pc-mcwq-qrg6Oct 13, 2026Vitess is vulnerable to SQL injection via quoted charset, collation and engine names that are re-serialized without quoting
- Affected
- >= 0.24.0, < 0.24.5; < 0.23.8; >= 24.0.0, < 24.0.5; < 23.0.8
- Patched in
- 0.24.5; 0.23.8; 24.0.5; 23.0.8
- highGHSA-pfg5-ppc7-ff45Oct 13, 2026Vitess is vulnerable to SQL injection via trailing-comment splitting that hides SQL from parsing, planning and ACL checks
- Affected
- >= 0.24.0, < 0.24.5; < 0.23.8; >= 24.0.0, < 24.0.5; < 23.0.8
- Patched in
- 0.24.5; 0.23.8; 24.0.5; 23.0.8
- highGHSA-9rx3-8pwm-c228Oct 13, 2026Vitess is vulnerable to SQL injection via a session system variable value that breaks out of the SET_VAR optimizer-hint comment
- Affected
- >= 0.24.0, < 0.24.5; < 0.23.8; >= 24.0.0, < 24.0.5; < 23.0.8
- Patched in
- 0.24.5; 0.23.8; 24.0.5; 23.0.8
- highGHSA-9248-hccp-qf8fOct 13, 2026Vitess is vulnerable to SQL injection via AST re-serialization of DATE, TIME and TIMESTAMP literals in SET system-variable statements
- Affected
- >= 0.24.0, < 0.24.5; < 0.23.8; >= 24.0.0, < 24.0.5; < 23.0.8
- Patched in
- 0.24.5; 0.23.8; 24.0.5; 23.0.8
- highGHSA-m282-7w35-g77mOct 13, 2026Vitess is vulnerable to SQL injection via an unvalidated global SET variable name re-emitted into a VTTablet validation query
- Affected
- >= 0.24.0, < 0.24.5; < 0.23.8; >= 24.0.0, < 24.0.5; < 23.0.8
- Patched in
- 0.24.5; 0.23.8; 24.0.5; 23.0.8
- highGHSA-92cc-q2h6-m2vrOct 13, 2026Vitess is vulnerable to SQL injection via convert_tz() arguments in a VStream filter written into the copy-phase snapshot query
- Affected
- >= 0.15.0, < 0.23.8; >= 0.24.0, < 0.24.5; >= 15.0.0, < 23.0.8; >= 24.0.0, < 24.0.5
- Patched in
- 0.23.8; 0.24.5; 23.0.8; 24.0.5
- mediumGHSA-3fr2-mqr5-r5x5Oct 5, 2026VTAdmin's state-changing API routes accept cross-site GET requests
- Affected
- < 0.23.8; >= 0.24.0, < 0.24.5; < 23.0.8; >= 24.0.0, < 24.0.5
- Patched in
- 0.23.8; 0.24.5; 23.0.8; 24.0.5
- highGHSA-c2r8-grjp-w8c2Oct 5, 2026VTAdmin's VExplain API lets a user with read access execute DML
- Affected
- >= 0.22.0, < 0.23.8; >= 0.24.0, < 0.24.5; >= 22.0.0, < 23.0.8; >= 24.0.0, < 24.0.5
- Patched in
- 0.23.8; 0.24.5; 23.0.8; 24.0.5
- mediumGHSA-78h7-x6qm-xpr8Oct 5, 2026vtadmin ReloadSchemaShard API missing RBAC authorization check
- Affected
- >= 0.15.0, < 0.23.8; >= 0.24.0, < 0.24.5; >= 15.0.0, < 23.0.8; >= 24.0.0, < 24.0.5
- Patched in
- 0.23.8; 0.24.5; 23.0.8; 24.0.5
- highGHSA-c28j-qmfx-4gxpOct 5, 2026Vitess is vulnerable to SQL injection when the MySQL connection uses a multibyte character set whose characters can contain ASCII bytes
- Affected
- < 0.23.8; >= 0.24.0, < 0.24.5; < 23.0.8; >= 24.0.0, < 24.0.5
- Patched in
- 0.23.8; 0.24.5; 23.0.8; 24.0.5
- highGHSA-8w3p-4xg5-rm9wOct 5, 2026Vitess is vulnerable to SQL injection via unescaped table identifiers in Online DDL statements executed as the DBA user
- Affected
- < 0.23.8; >= 0.24.0, < 0.24.5; < 23.0.8; >= 24.0.0, < 24.0.5
- Patched in
- 0.23.8; 0.24.5; 23.0.8; 24.0.5
- highGHSA-73pp-99vw-h5g8Oct 5, 2026Vitess is vulnerable to SQL injection via unvalidated VStream LastPK values written into the copy-phase snapshot query
- Affected
- < 0.23.8; >= 0.24.0, < 0.24.5; < 23.0.8; >= 24.0.0, < 24.0.5
- Patched in
- 0.23.8; 0.24.5; 23.0.8; 24.0.5
- highGHSA-gxcp-3jmq-3f43Oct 5, 2026VReplication: JSON object keys not SQL-escaped in PARTIAL_JSON binlog diffs (SQL injection into target apply)
- Affected
- >= 0.22.0, < 0.23.6; >= 0.24.0, < 0.24.3; >= 22.0.0, < 23.0.6; >= 24.0.0, < 24.0.3
- Patched in
- 0.23.6; 0.24.3; 23.0.6; 24.0.3
- highGHSA-x56j-8c72-5xggOct 4, 2026Vitess: SQL Injection via AnnotateQueries CallerID Comment Escape
- Affected
- < 0.23.8; >= 0.24.0, < 0.24.5; < 23.0.8; >= 24.0.0, < 24.0.5
- Patched in
- 0.23.8; 0.24.5; 23.0.8; 24.0.5
- mediumGHSA-wm8m-m48g-pf63Sep 25, 2026EXPLAIN ANALYZE DML bypasses strict table ACL enforcement | pkg:github/vitessio/vitess
- Affected
- < 0.23.7; >= 0.24.0, < 0.24.4; < 23.0.7; >= 24.0.0, < 24.0.4
- Patched in
- 0.23.7; 0.24.4; 23.0.7; 24.0.4
- mediumGHSA-fr6v-4xmf-vvjxSep 23, 2026SQL Injection via Type_RAW Bind Variables in VTGate gRPC API
- Affected
- >= 0.18.7, <= 0.18.8; >= 0.19.6, <= 0.19.10; >= 0.20.2, < 0.23.4; >= 0.24.0-rc1, < 0.24.0; >= 18.0.7, <= 18.0.8; >= 19.0.6, <= 19.0.10; >= 20.0.2, < 23.0.4; >= 24.0.0-rc1, < 24.0.0
- Patched in
- 0.23.4; 0.24.0; 23.0.4; 24.0.0
- mediumGHSA-gpx4-c9vj-vxrpSep 22, 2026Fix vtctld keyspace/shard actions bypass configured --security-policy
- Affected
- < 0.23.7; >= 0.24.0, < 0.24.4; < 23.0.7; >= 24.0.0, < 24.0.4
- Patched in
- 0.23.7; 0.24.4; 23.0.7; 24.0.4
- highGHSA-8w9q-hpjc-5xrfSep 21, 2026Vitess is vulnerable to SQL injection via AST re-serialization of SHOW statements on the vttablet streaming path
- Affected
- >= 0.24.0, < 0.24.4; >= 0.23.0, < 0.23.7; >= 24.0.0, < 24.0.4; >= 23.0.0, < 23.0.7
- Patched in
- 0.24.4; 0.23.7; 24.0.4; 23.0.7
- highGHSA-w6mx-2f8x-pqf4Sep 9, 2026DO statements bypass strict table ACL at vttablet (v24.0.3) complete column-value extraction from an ACL-denied table
- Affected
- < 0.23.7; >= 0.24.0, < 0.24.4; < 23.0.7; >= 24.0.0, < 24.0.4
- Patched in
- 0.23.7; 0.24.4; 23.0.7; 24.0.4
- highGHSA-fxqj-c35w-x6rqSep 9, 2026Fix vttls CRL revocation check silently skipped under InsecureSkipVerify and TLS session resumption
- Affected
- < 0.23.7; >= 0.24.0, < 0.24.4; < 23.0.7; >= 24.0.0, < 24.0.4
- Patched in
- 0.23.7; 0.24.4; 23.0.7; 24.0.4
- criticalCVE-2026-104252Jul 27, 2026Vitess vttablet /twopcz reflected XSS
- Affected
- < 0.23.5; >= 0.24.0, < 0.24.2; < 23.0.5; >= 24.0.0, < 24.0.2
- Patched in
- 0.23.5; 0.24.2; 23.0.5; 24.0.2
- mediumCVE-2026-65959Jul 3, 2026Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
- Affected
- < 0.23.6; >= 0.24.0, < 0.24.3; < 23.0.6; >= 24.0.0, < 24.0.3
- Patched in
- 0.23.6; 0.24.3; 23.0.6; 24.0.3
- criticalCVE-2026-27969Feb 25, 2026Users with backup storage access can write to arbitrary file paths on restore
- Affected
- < 0.22.4; >= 0.23.0, < 0.23.3; < 22.0.4; >= 23.0.0, < 23.0.3
- Patched in
- 0.22.4; 0.23.3; 22.0.4; 23.0.3
- highCVE-2026-27965Feb 25, 2026Users with backup storage access can gain unauthorized access to production deployment environments
- Affected
- < 0.22.4; >= 0.23.0, < 0.23.3; < 22.0.4; >= 23.0.0, < 23.0.3
- Patched in
- 0.22.4; 0.23.3; 22.0.4; 23.0.3
- mediumCVE-2024-53257Dec 3, 2024HTML injection in /debug/querylogz & /debug/env
- Affected
- < 21.0.1, <20.0.4, <19.0.8
- Patched in
- 21.0.1, 20.0.4, 19.0.8
- mediumCVE-2024-32886May 8, 2024Simple query results in infinite memory consumption and vtgate crash
- Affected
- < 19.0.4, < 18.0.5, < 17.0.7
- Patched in
- 19.0.4, 18.0.5, 17.0.7
- mediumCVE-2023-29195May 11, 2023VTAdmin users that can create shards can deny access to other functions
- Affected
- <16.0.2
- Patched in
- v16.0.2
- mediumCVE-2023-29194Apr 11, 2023Users that can create keyspaces can deny access to already existing keyspaces
- Affected
- < 16.0.1
- Patched in
- 16.0.1