Skip to content
Heist/ feed
Back to feed
High

Vitess users with backup storage access can gain unauthorized access to production deployment environments

Type: advisorySources: OSV

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. Some workarounds are available. Those who intended to use an external decompressor then can always specify that decompressor command in the `--external-decompressor` flag value for `vttablet` and `vtbackup`. That then overrides any value specified in the manifest file. Those who did not intend to use an external decompressor, nor an internal one, can specify a value such as `cat` or `tee` in the `--external-decompressor` flag value for `vttablet` and `vtbackup` to ensure that a harmless command is always used.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-27965
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 03:36 UTC · Revision 1

Source evidence

Vitess users with backup storage access can gain unauthorized access to production deployment environments

core-osv · Original source

Published 26 Feb 2026, 01:49 UTC

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. Some workarounds are available. Those who intended to use an external decompressor then can always specify that decompressor command in the `--external-decompressor` flag value for `vttablet` and `vtbackup`. That then overrides any value specified in the manifest file. Those who did not intend to use an external decompressor, nor an internal one, can specify a value such as `cat` or `tee` in the `--external-decompressor` flag value for `vttablet` and `vtbackup` to ensure that a harmless command is always used.

osv:CVE-2026-27965
Complete source record
{
  "id": "6984514c79b89b304af062bdf42a1c6460752b2f1f635f5969b13ba2ea224ab0",
  "url": "https://osv.dev/vulnerability/CVE-2026-27965",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Vitess users with backup storage access can gain unauthorized access to production deployment environments",
    "summary": "Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. Some workarounds are available. Those who intended to use an external decompressor then can always specify that decompressor command in the `--external-decompressor` flag value for `vttablet` and `vtbackup`. That then overrides any value specified in the manifest file. Those who did not intend to use an external decompressor, nor an internal one, can specify a value such as `cat` or `tee` in the `--external-decompressor` flag value for `vttablet` and `vtbackup` to ensure that a harmless command is always used.",
    "evidence": "osv:CVE-2026-27965",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-27965",
      "aliases": [
        "CVE-2026-27965",
        "GHSA-8g8j-r87h-p36x",
        "GO-2026-4567"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/vitessio/vitess",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5b0d3ad22b7553e7a31dc1e02b8005f192cbe039"
                },
                {
                  "introduced": "bee41a670a0e18e7400364712263bab171ee89dc"
                },
                {
                  "fixed": "0466df5c81c56c9a3d6cad0d38991cf93b657fa2"
                },
                {
                  "fixed": "4c0173293907af9cb942a6683c465c3f1e9fdb5c"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "22.0.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "23.0.0"
                      },
                      {
                        "fixed": "23.0.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "4c0173293907af9cb942a6683c465c3f1e9fdb5c"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v23.0.2",
            "v0.23.2",
            "v23.0.1",
            "v0.23.1",
            "v22.0.3",
            "v0.22.3",
            "v22.0.2",
            "v0.22.2",
            "v23.0.0",
            "v0.23.0",
            "v22.0.1",
            "v0.22.1",
            "v22.0.0",
            "v0.22.0",
            "v22.0.0-rc3",
            "v0.22.0-rc3",
            "v22.0.0-rc2",
            "v0.22.0-rc2",
            "v22.0.0-rc1",
            "v0.22.0-rc1",
            "v10.0.0-rc1-mysql80",
            "v10.0.0-rc1",
            "v9.0.0-rc1",
            "v8.0.0-rc1",
            "v7.0.0-beta",
            "v6.0.0-rc.1",
            "v5.0.1",
            "v5.0.0",
            "v3.0.0-rc.3",
            "v3.0",
            "v3.0.0-rc.2",
            "v3.0.0-rc.1",
            "v2.2.0-rc.1",
            "v2.2-alpha",
            "v2.2",
            "v2.1.0-alpha.1",
            "v2.0.0-rc.2",
            "v2.0.0-rc.1",
            "v2.0.0-beta.2",
            "v2.0.0-alpha5",
            "v2.0.0-alpha4",
            "v2.0.0-alpha2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27965.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.459967310Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27965.json",
        "https://github.com/vitessio/vitess/security/advisories/GHSA-8g8j-r87h-p36x",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-27965",
        "https://github.com/vitessio/vitess/issues/19459",
        "https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c",
        "https://github.com/vitessio/vitess/pull/19460"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-78"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27965.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-27965",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 517805,
  "published_at": "2026-02-26T01:49:10.071+00:00"
}