# vitess.io/vitess (Go) vulnerabilities 8 known vulnerabilities (2 critical, 1 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v0.24.5 (Oct 13, 2026): no advisory affects it - Newest unaffected release: v2.1.1+incompatible (May 22, 2017) - Releases: 237 since v0.7.0 (Jul 28, 2020) - Registry: https://pkg.go.dev/vitess.io/vitess - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-104252: v0.7.0 to v0.23.4 (v0.23.5 is outside it); v0.24.0 to v0.24.1 (v0.24.2 is outside it) - CVE-2026-65959: v0.7.0 to v0.23.6 (v0.23.7 is outside it); v0.24.0-rc1 to v0.24.2 (v0.24.3 is outside it) - CVE-2026-27969: v0.7.0 to v0.22.3 (v0.22.4 is outside it); v0.23.0-rc1 to v0.23.2 (v0.23.3 is outside it) - CVE-2026-27965: v0.7.0 to v0.23.2 (v0.23.3 is outside it) - CVE-2024-53257: v0.7.0 to v0.19.7 (v0.19.8 is outside it); v0.20.0-rc1 to v0.20.3 (v0.20.4 is outside it); v0.21.0-rc1 to v0.21.0 (v0.21.1 is outside it) - CVE-2024-32886: v0.7.0 to v0.17.6 (v0.17.7 is outside it); v0.18.0 to v0.18.4 (v0.18.5 is outside it); v0.19.0 to v0.19.3 (v0.19.4 is outside it) - CVE-2023-29195: v0.7.0 to v0.16.1 (v0.16.2 is outside it) - CVE-2023-29194: v0.7.0 to v0.16.0 (v0.16.1 is outside it) ## Advisories (8) ### [CVE-2026-104252](https://cve.now/CVE-2026-104252): Vitess vttablet /twopcz reflected XSS - Severity: Critical 9.8 - Published: Oct 13, 2026 - Affected: fixed in 0.23.5; from 0.24.0, fixed in 0.24.2; fixed in 0.23.5; from 0.24.0, fixed in 0.24.2. - Fixed in v0.23.5 (released Jun 24, 2026, 111 days before disclosure) and v0.24.2 (released Jun 24, 2026, 111 days before disclosure). - The latest release, v0.24.5, is not affected. ### [CVE-2026-65959](https://cve.now/CVE-2026-65959): Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data - Severity: Medium 5.3 - Published: Aug 18, 2026 - Affected: from 0.24.0-rc1, through 0.24.2; through 0.23.6; fixed in 0.23.6; from 0.24.0-rc1, fixed in 0.24.3. - Fixed in v0.24.3 (released Sep 3, 2026, 16 days after disclosure). - The latest release, v0.24.5, is not affected. ### [CVE-2026-27969](https://cve.now/CVE-2026-27969): Vitess users with backup storage access can write to arbitrary file paths on restore - Severity: Critical 9.3 - Published: Feb 26, 2026 - Affected: fixed in 0.22.4; from 0.23.0-rc1, fixed in 0.23.3; from 0.23.0-rc1, fixed in 0.23.3; fixed in 0.22.4. - Fixed in v0.22.4 (released Feb 27, 2026, 1 day after disclosure) and v0.23.3 (released Feb 27, 2026, 1 day after disclosure). - The latest release, v0.24.5, is not affected. ### [CVE-2026-27965](https://cve.now/CVE-2026-27965): Vitess users with backup storage access can gain unauthorized access to production deployment environments - Severity: High 8.4 - Published: Feb 26, 2026 - Affected: fixed in 0.22.4; from 0.23.0, fixed in 0.23.3; through 0.23.2. - Fixed in v0.23.3 (released Feb 27, 2026, 1 day after disclosure). - The latest release, v0.24.5, is not affected. ### [CVE-2024-53257](https://cve.now/CVE-2024-53257): Vitess allows HTML injection in /debug/querylogz & /debug/env - Severity: Medium 4.9 - Published: Dec 3, 2024 - Affected: fixed in 0.19.8; from 0.20.0, fixed in 0.20.4; from 0.21.0, fixed in 0.21.1; from 0.21.0-rc1, fixed in 0.21.1; from 0.20.0-rc1, fixed in 0.20.4; fixed in 0.19.8. - Fixed in v0.19.8 (released Dec 3, 2024, the day of disclosure), v0.20.4 (released Dec 3, 2024, the day of disclosure) and v0.21.1 (released Dec 3, 2024, the day of disclosure). - The latest release, v0.24.5, is not affected. ### [CVE-2024-32886](https://cve.now/CVE-2024-32886): Vitess vulnerable to infinite memory consumption and vtgate crash - Severity: Medium 4.9 - Published: May 8, 2024 - Affected: fixed in 0.17.7; from 0.18.0, fixed in 0.18.5; from 0.19.0, fixed in 0.19.4; fixed in 0.17.7; from 0.18.0, fixed in 0.18.5; from 0.19.0, fixed in 0.19.4. - Fixed in v0.17.7 (released May 8, 2024, the day of disclosure), v0.18.5 (released May 8, 2024, the day of disclosure) and v0.19.4 (released May 8, 2024, the day of disclosure). - The latest release, v0.24.5, is not affected. ### [CVE-2023-29195](https://cve.now/CVE-2023-29195): Vitess VTAdmin users that can create shards can deny access to other functions - Severity: Medium 4.1 - Published: May 11, 2023 - Affected: fixed in 0.16.2. - Fixed in v0.16.2 (released May 9, 2023, 2 days before disclosure). - The latest release, v0.24.5, is not affected. ### [CVE-2023-29194](https://cve.now/CVE-2023-29194): vitess allows users to create keyspaces that can deny access to already existing keyspaces - Severity: Medium 4.1 - Published: Apr 14, 2023 - Affected: fixed in 0.16.1. - Fixed in v0.16.1 (released Mar 30, 2023, 15 days before disclosure). - The latest release, v0.24.5, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/vitess.io/vitess Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.