Read the docs
TI-2023-13622 Aliases CVE-2023-29194GHSA-735r-hv67-g38f

vitess allows users to create keyspaces that can deny access to already existing keyspaces

Priority LOW 21CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00782 56th percentileScored 2026-11-07
Fix Fixed vitess (vitessio): 0.16.1vitess.io/vitess (Go): 0.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagevitessbefore 0.16.10.16.1Patch availableCNA
—vitess.io/vitess (Go)before 0.16.10.16.1Patch availableGHSA-735r-hv67-g38f
  • vitess Vendorbackstage Affected before 0.16.1 Fixed in 0.16.1 Patch available CNA
  • vitess.io/vitess (Go) Vendor— Affected before 0.16.1 Fixed in 0.16.1 Patch available GHSA-735r-hv67-g38f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:*before 16.0.1Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:* Versions before 16.0.1 Vulnerable ·backstage

Remediation

  • Fix · CNA vitess (vitessio) Fixed in 0.16.1
  • Fix · GHSA-735r-hv67-g38f vitess.io/vitess (Go) Fixed in 0.16.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29194
  2. 2026-10-03 Alias added: GHSA-735r-hv67-g38f

References

Patch 1

Advisory 2

Other 3

  • TI-2026-22308 Vitess users with backup storage access can gain unauthorized access to production deployment environments CVSS 4.0HIGH 8.4
  • TI-2026-46986 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data CVSS 3.1MEDIUM 5.3
  • TI-2026-73584 Reflected cross-site scripting in Vitess vttablet /twopcz endpoint CVSS 3.1CRITICAL 9.8
  • TI-2026-22312 Vitess users with backup storage access can write to arbitrary file paths on restore CVSS 4.0CRITICAL 9.3
  • TI-2023-13623 Vitess VTAdmin users that can create shards can deny access to other functions CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences