Vitess

v23.0.8Storage & Data

Oct 13, 2026

A security-focused maintenance release fixes SQL injection and authorization vulnerabilities while tightening SQL parsing, table ACL, character-set, and `VExplain` enforcement. Changes to `sql_mode` and connection settings may require operator configuration updates.

Action needed (7)

securityGlobal SET variable-name SQL injection fix, GHSA-m282-7w35-g77m
Fixes GHSA-m282-7w35-g77m, which allowed SQL injection through a global SET variable name.
GHSA-m282-7w35-g77m
securityDate and time literal SQL injection fix, GHSA-9248-hccp-qf8f
Fixes GHSA-9248-hccp-qf8f, which allowed SQL injection through DATE, TIME, and TIMESTAMP literals.
GHSA-9248-hccp-qf8f
securitySET_VAR session variable SQL injection fix, GHSA-9rx3-8pwm-c228
Fixes GHSA-9rx3-8pwm-c228, which allowed SQL injection through a session variable value carried in a SET_VAR hint.
GHSA-9rx3-8pwm-c228
securityTrailing-comment parsing and table ACL fix, GHSA-pfg5-ppc7-ff45
Fixes GHSA-pfg5-ppc7-ff45, which allowed SQL to be hidden from parsing and table ACL checks in a trailing comment.
GHSA-pfg5-ppc7-ff45
securityMalformed numeric bind-variable SQL injection fix, GHSA-xf67-9r78-xv82
Fixes GHSA-xf67-9r78-xv82, which allowed SQL injection through malformed numeric bind variables.
GHSA-xf67-9r78-xv82
breakingRejection of empty table option names
Empty charset, collation, engine, and partition tablespace names are now rejected.
breakingQuoted ENCRYPTION values
ENCRYPTION now requires a quoted value.

Check if affected (14)

securityTable ACL enforcement for privileged callers, GHSA-w6mx-2f8x-pqf4
Applicability is not stated in the release notes.
A caller with reader, writer, and admin roles across every table can now run DO, REPAIR, OPTIMIZE, and partially parsed CREATE TABLE statements under the table ACL checks. This fixes GHSA-w6mx-2f8x-pqf4.
securityRestricted MySQL connection character sets, GHSA-c28j-qmfx-4gxp
Applies if you configure --db-charset.
--db-charset and other MySQL connection character-set configuration points no longer accept sjis, cp932, gb18030, gbk, big5, ucs2, utf16, utf16le, or utf32, whether specified as character sets or collations. This fixes GHSA-c28j-qmfx-4gxp.
securityRead-only VExplain statement enforcement, GHSA-c2r8-grjp-w8c2
Applies if you use VExplain.
For the affected modes, VTAdmin accepts only a SELECT without INTO, sequence next-values, or advisory lock functions, and runs it in a read-only transaction that is always rolled back. This fixes GHSA-c2r8-grjp-w8c2.
securityVStream LastPK SQL injection fix, GHSA-73pp-99vw-h5g8
Applies if VStream runs.
Fixes GHSA-73pp-99vw-h5g8, which allowed SQL injection through VStream LastPK values.
GHSA-73pp-99vw-h5g8
securityVStream filter SQL injection fix, GHSA-92cc-q2h6-m2vr
Applies if VStream runs.
Fixes GHSA-92cc-q2h6-m2vr, which allowed SQL injection through convert_tz() arguments in a VStream filter.
GHSA-92cc-q2h6-m2vr
securityOnline DDL table-name SQL injection fix, GHSA-8w3p-4xg5-rm9w
Applies if Online DDL runs.
Fixes GHSA-8w3p-4xg5-rm9w, which allowed SQL injection through table names in Online DDL statements.
GHSA-8w3p-4xg5-rm9w
securityQuery annotation caller-ID SQL injection fix, GHSA-x56j-8c72-5xgg
Applies if you configure --queryserver-config-annotate-queries.
Fixes GHSA-x56j-8c72-5xgg, which allowed SQL injection through the caller ID in query annotations configured by --queryserver-config-annotate-queries.
GHSA-x56j-8c72-5xgg
securityVTAdmin cross-site state-change request fix, GHSA-3fr2-mqr5-r5x5
Applies if VTAdmin runs.
Fixes GHSA-3fr2-mqr5-r5x5. VTAdmin API routes that change cluster state no longer accept cross-site GET requests.
GHSA-3fr2-mqr5-r5x5
securityVTAdmin ReloadSchemaShard RBAC enforcement, GHSA-78h7-x6qm-xpr8
Applies if you use ReloadSchemaShard.
Fixes GHSA-78h7-x6qm-xpr8. VTAdmin's ReloadSchemaShard now checks RBAC.
GHSA-78h7-x6qm-xpr8
breakingVTGate sql_mode assignment semantics
Applies if VTGate runs.
VTGate now implements MySQL 8.x sql_mode assignment semantics and validates every assignment against them.
breakingUnsupported sql_mode assignment rejection
Applies if you configure sql_mode.
Unsupported modes are rejected even when the underlying MySQL server already uses the mode and the SET would not change its value.
breakingMySQL errors for invalid sql_mode values
Applies if you configure sql_mode.
Unknown mode names and invalid numeric values now return MySQL errors ER_WRONG_VALUE_FOR_VAR (1231) and ER_UNSUPPORTED_SQL_MODE (3899) for mode bits removed in MySQL 8.0.
breakingVTTablet sql_mode validation
Applies if VTTablet runs.
VTTablet applies the same sql_mode validation at its entry points and returns the same errors.
breakingInherited session sql_mode filtering
Applies if you configure sql_mode.
Every MySQL connection created by Vitess strips modes that change SQL text interpretation from the session sql_mode inherited from the server's global value.

All 7 other recorded changesvalue changes 7

value changes (7)

Numeric values decode against MySQL's sql_mode bitmask.
Constant values are validated at planning time, with no shard round trip.
These checks are counted under the undetermined-table-set TableName label, in TableACLDenied, or in TableACLAllowed for a caller with every role on every table.
A charset, collation, engine, tablespace or full-text parser name is now decoded when parsed, and written back as a single token when Vitess regenerates the statement
A quoted name is normalized.
Only known names stay bare.
COLLATE binary in an expression is quoted.

Add Vitess to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Vitess releases →