RATATOSKRATATOSK
Sign in

Vitess

v24.0.5Storage & Data
Oct 13, 2026

ACTION 5CHECK 10OTHER 15

A security-focused maintenance release hardens SQL parsing, authorization, and connection handling. It also introduces operator-visible restrictions and migration actions, especially for SQL modes, character sets, and access controls.

Action needed (5)

Check if affected (10)

  • securityRestricted MySQL connection character sets

    Applies if you configure --db-charset.

    Vitess no longer accepts sjis, cp932, gb18030, gbk, big5, ucs2, utf16, utf16le, or utf32 in --db-charset or other MySQL connection character set configuration points. This addresses GHSA-c28j-qmfx-4gxp.

  • securityThe VExplain execute action requirement

    Applies if you use VExplain and do not configure execute.

    The affected modes now require the new execute action on the VExplain resource. This addresses GHSA-c2r8-grjp-w8c8.

  • securityVStream LastPK injection fix, GHSA-73pp-99vw-h5g8

    Applies if you run VStream.

    Vitess fixes SQL injection through VStream LastPK values. This addresses GHSA-73pp-99vw-h5g8.

    GHSA-73pp-99vw-h5g8

  • securityVStream convert_tz() injection fix, GHSA-92cc-q2h6-m2vr

    Applies if you run VStream.

    Vitess fixes SQL injection through convert_tz() arguments in a VStream filter. This addresses GHSA-92cc-q2h6-m2vr.

    GHSA-92cc-q2h6-m2vr

  • securityOnline DDL table-name injection fix, GHSA-8w3p-4xg5-rm9w

    Applies if you run Online DDL.

    Vitess fixes SQL injection through table names in Online DDL statements. This addresses GHSA-8w3p-4xg5-rm9w.

    GHSA-8w3p-4xg5-rm9w

  • securityQuery annotation caller-ID injection fix, GHSA-x56j-8c72-5xgg

    Applies if you enable --queryserver-config-annotate-queries.

    Vitess fixes SQL injection through the caller ID in query annotations controlled by --queryserver-config-annotate-queries. This addresses GHSA-x56j-8c72-5xgg.

    GHSA-x56j-8c72-5xgg

  • securityTrailing-comment parsing and table ACL fix, GHSA-pfg5-ppc7-ff45

    Applies if you use table ACL checks.

    Vitess fixes SQL that was hidden from parsing and table ACL checks in a trailing comment. This addresses GHSA-pfg5-ppc7-ff45.

    GHSA-pfg5-ppc7-ff45

  • securityVTAdmin cross-site GET request restriction, GHSA-3fr2-mqr5-r5x5

    Applies if you run VTAdmin.

    VTAdmin API routes that change cluster state no longer accept cross-site GET requests. This addresses GHSA-3fr2-mqr5-r5x5.

    GHSA-3fr2-mqr5-r5x5

  • securityRBAC enforcement for VTAdmin ReloadSchemaShard, GHSA-78h7-x6qm-xpr8

    Applies if you run VTAdmin.

    VTAdmin's ReloadSchemaShard now checks RBAC. This addresses GHSA-78h7-x6qm-xpr8.

    GHSA-78h7-x6qm-xpr8

  • breakingStricter sql_mode assignment validation

    Applies if you configure sql_mode.

    Vitess now rejects an unsupported sql_mode even when the underlying MySQL server already uses that mode and the assignment would not change its value.

All 15 other recorded changessecurity fixes 2 · value changes 7 · constraints 2 · defaults 2 · fixes 2

security fixes (2)

  • A caller that is a reader, a writer and an admin in a table group covering every table ("table_names_or_prefixes": ["%"]) holds every role on any table such a statement could touch, so DO, REPAIR, OPTIMIZE and a partially parsed CREATE TABLE now run for it.
  • For those modes VTAdmin also accepts only a SELECT without INTO, sequence next-values or advisory lock functions

value changes (7)

  • Unknown mode names and invalid numeric values fail with MySQL's own errors: ER_WRONG_VALUE_FOR_VAR (1231), and ER_UNSUPPORTED_SQL_MODE (3899) for the bits of modes removed in MySQL 8.0.
  • Constant values are validated at planning time, with no shard round trip.
  • These checks are counted under the undetermined-table-set TableName label, in TableACLDenied, or in TableACLAllowed for a caller with every role on every table.
  • A charset, collation, engine, tablespace or full-text parser name is now decoded when parsed, and written back as a single token when Vitess regenerates the statement
  • Only known names stay bare.
  • COLLATE binary in an expression is quoted.
  • COLLATE 'utf8_bin' regenerates as COLLATE utf8_bin

constraints (2)

  • Numeric values decode against MySQL's sql_mode bitmask.
  • ENCRYPTION requires a quoted value.

defaults (2)

  • Every MySQL connection Vitess creates now strips the modes that change how SQL text is interpreted from the session sql_mode it inherits from the server's global value.
  • The VExplain page in the web UI now defaults to PLAN.

fixes (2)

  • VTGate now implements MySQL 8.x's sql_mode assignment semantics and validates every assignment against them:
  • VTTablet applies the same validation at its own entry points and returns the same errors
Add Vitess to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Vitess releases →