Loading...
Skip to main content
GeekWala

CVE-2026-27969 — Vulnerability in vitess.io/vitess — CVE Details

CRITICAL

Vitess users with backup storage access can write to arbitrary file paths on restore

Published February 27, 2026Updated March 23, 2026Source: osv

Summary

### Impact Anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — which may be files that they have also added to the manifest and backup contents — are written to any accessible location on restore. This is a common [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal) security issue. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. ### Patches v23.0.3 and v22.0.4 ### Resources https://github.com/vitessio/vitess/pull/19470

Advisory Timeline

  • First published February 27, 2026 (227 days ago).
  • Last revised March 23, 2026 — 24 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update vitess.io/vitess to 0.23.3 or later
go get vitess.io/vitess@v0.23.3
Go
Update vitess.io/vitess to 0.22.4 or later
go get vitess.io/vitess@v0.22.4

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
vitess.io/vitess
go
All versions0.23.3
vitess.io/vitess
go
All versions0.22.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.3 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
P
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:H/SA:H

References

Frequently Asked Questions

What is CVE-2026-27969?
Vitess users with backup storage access can write to arbitrary file paths on restore This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 8.3/10).
How do I check if my project is affected by CVE-2026-27969?
CVE-2026-27969 affects vitess.io/vitess. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-27969 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.3

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-r492-hjgh-c9gw
GO-2026-4570

Related CVEs

  • CVE-2026-107806
    CRITICAL

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

  • CVE-2026-68582
    CRITICAL

    Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

  • CVE-2026-27965
    HIGH

    Vitess users with backup storage access can gain unauthorized access to production deployment environments

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies