Vitess
CVE-2026-27969
HIGH
GHSA-r492-hjgh-c9gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess backup storage location with credentials
-
DeliveryModify backup manifest file entries
-
ExploitInject path traversal sequences in file paths
-
ExecutionRestore backup to write files to arbitrary locations
-
ImpactExecute code or access sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker requires read/write access to backup storage location (e.g., S3 bucket) where Vitess backup manifests are stored. Affects Vitess versions before 23.0.3 and 22.0.4 with backups containing manipulable manifest files. |
| Impact | CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation no authentication required. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Path traversal in Vitess backup manifest handling allows authenticated attackers with access to backup storage to write arbitrary files to any location during restore operations, potentially achieving remote code execution on production MySQL deployments. An attacker can manipulate backup manifests to extract files outside intended directories, gaining unauthorized access to sensitive data and the ability to execute arbitrary commands in the production environment. Patches are available for versions 23.0.3 and 22.0.4.
Earlier versions of this analysis (1)
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. [CVSS 8.8 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-22 (Path Traversal). Affects Vitess. Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — which may be files that they have also added to the manifest and backup contents — are written to any accessible location on restore. This is a common path traversal security issue. This can be used to provide that attacker with unintended/u
Know when Vitess gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest - which may be files that they have also added to the manifest and backup contents - are written to any accessible location on restore. This is a common path traversal security issue. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment - allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. No known workarounds are available.
Executive ViewAI
CVE-2026-27969 affects Vitess database clustering systems and allows attackers with backup storage access to potentially compromise database integrity and confidentiality. Organizations running affected Vitess versions risk unauthorized data access and manipulation through an often-overlooked attack vector, making this a critical priority for database administrators and infrastructure teams.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict backup storage access to authorized personnel and systems only using network segmentation and IAM policies; (2) Enable encryption at rest for all backup data; (3) Implement continuous monitoring and alerting on backup storage access; (4) Audit all current and recent backup access logs for suspicious activity; (5) Consider temporary isolation of non-critical Vitess clusters until patches are applied.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)GitHub Advisory
Reflected cross-site scripting in the Vitess vttablet and vtcombo /twopcz HTTP debug endpoint allows a remote, unauthent
Command injection in Vitess MySQL clustering system before 23.0.3/22.0.4. Users with read/write access to the backup sto
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Rated medium severi
Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL st
Vitess is a database clustering system for horizontal scaling of MySQL. Rated low severity (CVSS 2.7), this vulnerabilit
Exploit-DB