What is the CVSS score of CVE-2026-27965?

CVE-2026-27965 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-27965?

Within 24 hours: Audit all backup storage locations and verify access controls are properly restricted. Within 7 days: Apply vendor patches to upgrade Vitess to version 23.0.3 or 22.0.4 or later across all affected instances. Within 30 days: Conduct security review of backup storage architecture, implement encryption at rest/transit for backups, and validate patch deployment across entire environment.

Vitess CVE-2026-27965

CRITICAL

OS Command Injection (CWE-78)

2026-02-26 security-advisories@github.com

GHSA-8g8j-r87h-p36x

MySQL Vitess Suse Linuxfoundation

9.9

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain access to backup storage location
Delivery

Modify backup manifest files
Exploit

Inject malicious code into manifest
Execution

Restore backup in production
Impact

Execute arbitrary commands on database server

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Authenticated read/write access to backup storage location (e.g., S3 bucket) where Vitess backups are stored; backup restoration process must be triggered on target Vitess deployment using manipulated manifest files.
Impact	CVSS 9.9 with scope change. Vitess clusters manage production databases — compromise enables access to all database data.
Exploit ScenarioDerived	Attacker with backup store access injects commands through backup metadata, executing code on the Vitess control plane.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Command injection in Vitess MySQL clustering system before 23.0.3/22.0.4. Users with read/write access to the backup store can achieve code execution. Patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.9

Command injection in Vitess MySQL clustering.

RemediationAI

Update Vitess.

Affected Packages

go vitess.io/vitess fix: 0.22.4, 0.23.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-78 OS command injection through the backup functionality. Vitess manages horizontal scaling of MySQL databases.

Know when Vitess gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SUSE CRITICAL

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 02, 2026 - 18:36 nvd

Patch available

CVE Published

Feb 26, 2026 - 02:16 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment - allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. Some workarounds are available. Those who intended to use an external decompressor then can always specify that decompressor command in the --external-decompressor flag value for vttablet and vtbackup. That then overrides any value specified in the manifest file. Those who did not intend to use an external decompressor, nor an internal one, can specify a value such as cat or tee in the --external-decompressor flag value for vttablet and vtbackup to ensure that a harmless command is always used.

Executive ViewAI

Why It Matters

CVE-2026-27965 is a critical vulnerability in Vitess database clustering that allows attackers with backup storage access to compromise database integrity and confidentiality. Organizations running Vitess databases face immediate risk of unauthorized data access and potential data exfiltration if backup storage is insufficiently protected.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible, implement: (1) Restrict backup storage access via network segmentation and IAM policies limiting to essential personnel only, (2) Enable encryption for all backup data at rest and in transit, (3) Monitor backup storage access logs for unauthorized activity, (4) Disable Vitess backup functionality if not operationally required.

Threat Intelligence Overview

EPSS Score

0.1%

Top 82% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.