vitessio/vitess Security Advisories | GitStock

critical2026-10-15

Vitess vttablet /twopcz reflected XSS

GHSA-v75v-6fpf-gvw8 · CVE-2026-104252

medium2026-08-18

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

GHSA-mhc4-g3wh-cw7m · CVE-2026-65959

critical2026-02-27

Vitess users with backup storage access can write to arbitrary file paths on restore

GHSA-r492-hjgh-c9gw · CVE-2026-27969

high2026-02-26

Vitess users with backup storage access can gain unauthorized access to production deployment environments

GHSA-8g8j-r87h-p36x · CVE-2026-27965

medium2024-12-03

Vitess allows HTML injection in /debug/querylogz & /debug/env

GHSA-7mwh-q3xm-qh6p · CVE-2024-53257

medium2024-05-08

Vitess vulnerable to infinite memory consumption and vtgate crash

GHSA-649x-hxfx-57j2 · CVE-2024-32886

medium2023-05-11

VTAdmin users that can create shards can deny access to other functions

GHSA-pqj7-jx24-wj7w · CVE-2023-29195

medium2023-04-11

vitess allows users to create keyspaces that can deny access to already existing keyspaces

GHSA-735r-hv67-g38f · CVE-2023-29194