Vitess

v23.0.7Storage & Data

Oct 1, 2026

A security-focused maintenance release closes TLS certificate revocation, table ACL, and legacy HTTP API attack surfaces. It also changes compression behavior, strengthens statement permission checks, and removes or deprecates `vtctld` interfaces that may affect compatible clients and Go package users.

Action needed (6)

securityTLS for gRPC clients configured with CRLs
A gRPC client with --tablet-grpc-crl, --vtgate-grpc-crl, --vtctld-grpc-crl, or another *-grpc-crl flag now connects with TLS and verifies the server against the system roots when neither a client certificate nor a CA is configured. Previously, it connected in plaintext with the CRL silently ignored. This addresses GHSA-fxqj-c35w-x6rq.
securityThe planbuilder.BuildPermissions result
The exported planbuilder.BuildPermissions function now returns a second result, tablesUndetermined bool, alongside the permissions. This change supports the strict table ACL enforcement addressed by GHSA-w6mx-2f8x-pqf4.
securityThe /api/ HTTP API
The HTTP API that vtctld served under /api/ has been removed. The affected components include vtctldclient and VtctldServer.
breakingThe --compression-level value 1, reassigned to the fast compressor
Values 0 and 1, including the default 1, now select the fast compressor. Previously, 1 requested a hash-chain search depth of 1.
breakingTargeted SET statements with subqueries
Targeted SET statements with subqueries must be avoided until every vtgate is upgraded, or the vtgate instances must be upgraded first.
breakingRemoved vtctld Go package symbols
For Go package users, vtctld.InitVtctld, vtctld.ActionRepository, vtctld.ActionResult, and vtctld.TabletWithURL have been removed.

Plan ahead (1)

deprecatedDeprecated vtctld and vtcombo API flagsremoval planned in v26
The --cell, --proxy-tablets, --action-timeout, and --tablet-health-keep-alive flags of vtctld and vtcombo are now deprecated no-ops. They previously configured the removed API.

All 12 other recorded changessecurity fixes 6 · value changes 3 · fixes 2 · additions 1

security fixes (6)

These denials have no table to name, so they are counted under a new TableName label, undetermined-table-set (with an empty TableGroup), in TableACLDenied.
A CRL only applies when the certificate of its issuer in the chain validates it.
A peer passes when any of its verified chains holds no revoked certificate
A trust anchor, that is, a CA certificate in the CA file that a chain ends at, is trusted as configured and not checked against its issuer's CRL.
When a CRL file holds several complete CRLs from one issuer, only the newest applies
A CRL whose authority key identifier names a different key than the CA certificate's, as the CRL of a re-keyed CA's predecessor does, is not held against that CA's certificates.

value changes (3)

The lz4 compression engine now uses the pierrec/lz4/v4 library instead of pierrec/lz4 v2. This fixes broken block decoding on amd64 in the v2 library.
A SET of a system variable in a session targeted at a shard (use ks:-80) is now evaluated once on the target shard
A server that has both flags also says so in its startup warning now.

fixes (2)

SELECT @@var after a non-constant targeted SET now returns the value instead of failing to evaluate the stored text.
A targeted SET that fails no longer leaves its value in the session.

additions (1)

now reports its connections by transport, tls or plaintext, in two new stats: GrpcOptionalTlsOpenConnections, the connections currently open, and GrpcOptionalTlsConnections, the connections handshaken so far.

Add Vitess to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Vitess releases →