CVE-2026-27965

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27965", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T03:24:57.793Z", "datePublished": "2026-02-26T01:49:10.071Z", "dateUpdated": "2026-02-26T19:32:59.874Z"}, "containers": {"cna": {"title": "Vitess users with backup storage access can gain unauthorized access to production deployment environments", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/vitessio/vitess/security/advisories/GHSA-8g8j-r87h-p36x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-8g8j-r87h-p36x"}, {"name": "https://github.com/vitessio/vitess/issues/19459", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitessio/vitess/issues/19459"}, {"name": "https://github.com/vitessio/vitess/pull/19460", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitessio/vitess/pull/19460"}, {"name": "https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c", "tags": ["x_refsource_MISC"], "url": "https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c"}], "affected": [{"vendor": "vitessio", "product": "vitess", "versions": [{"version": "< 22.0.4", "status": "affected"}, {"version": ">= 23.0.0, < 23.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T01:49:10.071Z"}, "descriptions": [{"lang": "en", "value": "Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment \u2014 allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. Some workarounds are available. Those who intended to use an external decompressor then can always specify that decompressor command in the `--external-decompressor` flag value for `vttablet` and `vtbackup`. That then overrides any value specified in the manifest file. Those who did not intend to use an external decompressor, nor an internal one, can specify a value such as `cat` or `tee` in the `--external-decompressor` flag value for `vttablet` and `vtbackup` to ensure that a harmless command is always used."}], "source": {"advisory": "GHSA-8g8j-r87h-p36x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T19:32:38.363771Z", "id": "CVE-2026-27965", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T19:32:59.874Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27965", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T19:32:38.363771Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T19:32:54.742Z"}}], "cna": {"title": "Vitess users with backup storage access can gain unauthorized access to production deployment environments", "source": {"advisory": "GHSA-8g8j-r87h-p36x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "vitessio", "product": "vitess", "versions": [{"status": "affected", "version": "< 22.0.4"}, {"status": "affected", "version": ">= 23.0.0, < 23.0.3"}]}], "references": [{"url": "https://github.com/vitessio/vitess/security/advisories/GHSA-8g8j-r87h-p36x", "name": "https://github.com/vitessio/vitess/security/advisories/GHSA-8g8j-r87h-p36x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vitessio/vitess/issues/19459", "name": "https://github.com/vitessio/vitess/issues/19459", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/vitessio/vitess/pull/19460", "name": "https://github.com/vitessio/vitess/pull/19460", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c", "name": "https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment \u2014 allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. Some workarounds are available. Those who intended to use an external decompressor then can always specify that decompressor command in the `--external-decompressor` flag value for `vttablet` and `vtbackup`. That then overrides any value specified in the manifest file. Those who did not intend to use an external decompressor, nor an internal one, can specify a value such as `cat` or `tee` in the `--external-decompressor` flag value for `vttablet` and `vtbackup` to ensure that a harmless command is always used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T01:49:10.071Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27965", "state": "PUBLISHED", "dateUpdated": "2026-02-26T19:32:59.874Z", "dateReserved": "2026-02-25T03:24:57.793Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T01:49:10.071Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vitess", "vendor": "vitessio", "versions": [{"status": "affected", "version": "< 22.0.4"}, {"status": "affected", "version": ">= 23.0.0, < 23.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:*", "matchCriteriaId": "918163A7-23FD-40D2-B3E3-7B7ED4E79E44", "versionEndExcluding": "22.0.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB25FA07-F72B-445D-AA0C-E97D2E5E7CC8", "versionEndExcluding": "23.0.3", "versionStartIncluding": "23.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment \u2014 allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. Some workarounds are available. Those who intended to use an external decompressor then can always specify that decompressor command in the `--external-decompressor` flag value for `vttablet` and `vtbackup`. That then overrides any value specified in the manifest file. Those who did not intend to use an external decompressor, nor an internal one, can specify a value such as `cat` or `tee` in the `--external-decompressor` flag value for `vttablet` and `vtbackup` to ensure that a harmless command is always used."}, {"lang": "es", "value": "Vitess es un sistema de cl\u00fasteres de bases de datos para el escalado horizontal de MySQL. Antes de las versiones 23.0.3 y 22.0.4, cualquier persona con acceso de lectura/escritura a la ubicaci\u00f3n de almacenamiento de copias de seguridad (por ejemplo, un bucket S3) pod\u00eda manipular los archivos de manifiesto de las copias de seguridad para que posteriormente se ejecutara c\u00f3digo arbitrario al restaurar dichas copias. Esto se puede utilizar para proporcionar al atacante un acceso no deseado/no autorizado al entorno de implementaci\u00f3n de producci\u00f3n, lo que le permite acceder a la informaci\u00f3n disponible en ese entorno, as\u00ed como ejecutar cualquier comando arbitrario adicional en \u00e9l. Las versiones 23.0.3 y 22.0.4 contienen un parche. Hay algunas soluciones alternativas disponibles. Aquellos que tengan intenci\u00f3n de utilizar un descompresor externo pueden especificar siempre ese comando de descompresi\u00f3n en el valor del indicador '--external-decompressor' para 'vttablet' y 'vtbackup'. Esto anula cualquier valor especificado en el archivo de manifiesto. Aquellos que no tengan intenci\u00f3n de utilizar un descompresor externo ni uno interno pueden especificar un valor como \u00abcat\u00bb o \u00abtee\u00bb en el valor del indicador '--external-decompressor' para 'vttablet' y 'vtbackup'a fin de garantizar que siempre se utilice un comando inofensivo."}], "id": "CVE-2026-27965", "lastModified": "2026-06-17T10:27:59.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27965", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T19:32:38.363771Z", "version": "2.0.3"}}]}, "published": "2026-02-26T02:16:23.647", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/vitessio/vitess/issues/19459"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/vitessio/vitess/pull/19460"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-8g8j-r87h-p36x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,22.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0,23.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vitess", "source": "cna", "vendor": "vitessio"}, "product": "vitess", "vendor": "vitessio"}], "analysis": {"en": {"generated_at": "2026-04-18T10:26:02.699115+00:00", "value": {"mitigation_remediation": ["Upgrade Vitess to version 22.0.4 or 23.0.3, which contain the official patch for the command injection flaw.", "If an upgrade is not immediately possible, configure the `--external-decompressor` flag for `vttablet` and `vtbackup` to a harmless command such as `cat` or `tee` so that any value provided in the manifest is overridden.", "Restrict write permissions on the backup storage bucket to only those users that absolutely need them; ensure read\u2011only or least\u2011privilege access for all other users.", "Monitor backup storage access logs for unexpected modifications to manifest files or unusual restore activity."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution and Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The affected product is Vitess provided by Linux Foundation / VitessIO. All releases from 22.0.0 up to and including 22.0.3, and from 23.0.0 up to and including 23.0.2, are vulnerable. Versions 22.0.4 and 23.0.3 contain the patch that eliminates the flaw.", "description_and_impact": "Vitess versions prior to 23.0.3 and 22.0.4 allow an attacker who can read and write to the backup storage location, such as an S3 bucket, to modify backup manifest files; when the backup is restored the program will execute the decompressor command specified in the manifest. This results in arbitrary code execution within the Vitess deployment, giving the attacker unauthorized access to production data and the ability to run any commands. The weakness is a command injection vulnerability (CWE\u201178).", "risk_and_exploitability": "The CVSS score of 8.4 marks this flaw as high severity, while the EPSS score of less than 1 percent indicates a low likelihood of exploitation at the time of this report. The vulnerability is not listed in the CISA KEV database, but if an attacker gains write access to the backup storage they can manipulate the manifest and trigger arbitrary code execution when the backup is restored. The attack vector requires the ability to modify backup files and to execute a backup restore in a production environment; no external network access is needed beyond what is normally required to access Vitess and the storage bucket."}}}}, "created": "2026-02-26T13:09:54.481264+00:00", "updated": "2026-04-18T10:30:35.764479+00:00", "vendors": ["vitessio", "vitessio$PRODUCT$vitess"]}