# Vitess v23.0.8

> Storage & Data · 2026-10-13

A security-focused maintenance release fixes SQL injection and authorization vulnerabilities while tightening SQL parsing, table ACL, character-set, and `VExplain` enforcement. Changes to `sql_mode` and connection settings may require operator configuration updates.

## Action needed
- **[security]** Global `SET` variable-name SQL injection fix, `GHSA-m282-7w35-g77m`
  - Fixes `GHSA-m282-7w35-g77m`, which allowed SQL injection through a global `SET` variable name.
- **[security]** Date and time literal SQL injection fix, `GHSA-9248-hccp-qf8f`
  - Fixes `GHSA-9248-hccp-qf8f`, which allowed SQL injection through `DATE`, `TIME`, and `TIMESTAMP` literals.
- **[security]** `SET_VAR` session variable SQL injection fix, `GHSA-9rx3-8pwm-c228`
  - Fixes `GHSA-9rx3-8pwm-c228`, which allowed SQL injection through a session variable value carried in a `SET_VAR` hint.
- **[security]** Trailing-comment parsing and table ACL fix, `GHSA-pfg5-ppc7-ff45`
  - Fixes `GHSA-pfg5-ppc7-ff45`, which allowed SQL to be hidden from parsing and table ACL checks in a trailing comment.
- **[security]** Malformed numeric bind-variable SQL injection fix, `GHSA-xf67-9r78-xv82`
  - Fixes `GHSA-xf67-9r78-xv82`, which allowed SQL injection through malformed numeric bind variables.
- **[breaking]** Rejection of empty table option names
  - Empty charset, collation, engine, and partition tablespace names are now rejected.
- **[breaking]** Quoted `ENCRYPTION` values
  - `ENCRYPTION` now requires a quoted value.

## Check if affected
- **[security]** Table ACL enforcement for privileged callers, GHSA-w6mx-2f8x-pqf4
  - Applicability is not stated in the release notes.
  - A caller with reader, writer, and admin roles across every table can now run `DO`, `REPAIR`, `OPTIMIZE`, and partially parsed `CREATE TABLE` statements under the table ACL checks. This fixes GHSA-w6mx-2f8x-pqf4.
- **[security]** Restricted MySQL connection character sets, GHSA-c28j-qmfx-4gxp
  - Applies if you configure `--db-charset`.
  - `--db-charset` and other MySQL connection character-set configuration points no longer accept `sjis`, `cp932`, `gb18030`, `gbk`, `big5`, `ucs2`, `utf16`, `utf16le`, or `utf32`, whether specified as character sets or collations. This fixes GHSA-c28j-qmfx-4gxp.
- **[security]** Read-only `VExplain` statement enforcement, GHSA-c2r8-grjp-w8c2
  - Applies if you use `VExplain`.
  - For the affected modes, VTAdmin accepts only a `SELECT` without `INTO`, sequence next-values, or advisory lock functions, and runs it in a read-only transaction that is always rolled back. This fixes GHSA-c2r8-grjp-w8c2.
- **[security]** `VStream` `LastPK` SQL injection fix, `GHSA-73pp-99vw-h5g8`
  - Applies if `VStream` runs.
  - Fixes `GHSA-73pp-99vw-h5g8`, which allowed SQL injection through `VStream` `LastPK` values.
- **[security]** `VStream` filter SQL injection fix, `GHSA-92cc-q2h6-m2vr`
  - Applies if `VStream` runs.
  - Fixes `GHSA-92cc-q2h6-m2vr`, which allowed SQL injection through `convert_tz()` arguments in a `VStream` filter.
- **[security]** Online DDL table-name SQL injection fix, `GHSA-8w3p-4xg5-rm9w`
  - Applies if Online DDL runs.
  - Fixes `GHSA-8w3p-4xg5-rm9w`, which allowed SQL injection through table names in Online DDL statements.
- **[security]** Query annotation caller-ID SQL injection fix, `GHSA-x56j-8c72-5xgg`
  - Applies if you configure `--queryserver-config-annotate-queries`.
  - Fixes `GHSA-x56j-8c72-5xgg`, which allowed SQL injection through the caller ID in query annotations configured by `--queryserver-config-annotate-queries`.
- **[security]** `VTAdmin` cross-site state-change request fix, `GHSA-3fr2-mqr5-r5x5`
  - Applies if `VTAdmin` runs.
  - Fixes `GHSA-3fr2-mqr5-r5x5`. `VTAdmin` API routes that change cluster state no longer accept cross-site `GET` requests.
- **[security]** VTAdmin `ReloadSchemaShard` RBAC enforcement, `GHSA-78h7-x6qm-xpr8`
  - Applies if you use `ReloadSchemaShard`.
  - Fixes `GHSA-78h7-x6qm-xpr8`. VTAdmin's `ReloadSchemaShard` now checks RBAC.
- **[breaking]** `VTGate` `sql_mode` assignment semantics
  - Applies if `VTGate` runs.
  - `VTGate` now implements MySQL 8.x `sql_mode` assignment semantics and validates every assignment against them.
- **[breaking]** Unsupported `sql_mode` assignment rejection
  - Applies if you configure `sql_mode`.
  - Unsupported modes are rejected even when the underlying MySQL server already uses the mode and the `SET` would not change its value.
- **[breaking]** MySQL errors for invalid `sql_mode` values
  - Applies if you configure `sql_mode`.
  - Unknown mode names and invalid numeric values now return MySQL errors `ER_WRONG_VALUE_FOR_VAR` (1231) and `ER_UNSUPPORTED_SQL_MODE` (3899) for mode bits removed in MySQL 8.0.
- **[breaking]** `VTTablet` `sql_mode` validation
  - Applies if `VTTablet` runs.
  - `VTTablet` applies the same `sql_mode` validation at its entry points and returns the same errors.
- **[breaking]** Inherited session `sql_mode` filtering
  - Applies if you configure `sql_mode`.
  - Every MySQL connection created by Vitess strips modes that change SQL text interpretation from the session `sql_mode` inherited from the server's global value.

## Other recorded changes
- 7 (value_changed 7)

[Full analysis](https://ratatosk.io/en/releases/vitess/v23.0.8)

[Original release notes](https://github.com/vitessio/vitess/releases/tag/v23.0.8)