CVE-2026-27969: falha crítica em vitessio vitess
Vitess users with backup storage access can write to arbitrary file paths on restore
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.5%
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — which may be files that they have also added to the manifest and backup contents — are written to any accessible location on restore. This is a common path traversal security issue. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. No known workarounds are available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:H/SA:H
Produtos afetados
vitessio · vitessCVEs relacionadas — vitessio vitess
No mesmo produto, das mais perigosas para as menos.
CVE-2026-104252CRITICALVitess vttablet /twopcz reflected XSSEPSS 1.2%CVE-2023-29195MEDIUMVitess VTAdmin users that can create shards can deny access to other functionsEPSS 1.0%CVE-2023-29194MEDIUMvitess allows users to create keyspaces that can deny access to already existing keyspacesEPSS 0.8%CVE-2024-32886MEDIUMVitess vulnerable to infinite memory consumption and vtgate crashEPSS 0.8%CVE-2026-27965HIGHVitess users with backup storage access can gain unauthorized access to production deployment environmentsEPSS 0.5%CVE-2024-53257MEDIUMVitess allows HTML injection in /debug/querylogz & /debug/envEPSS 0.4%