Read the docs
TI-2023-13623 Aliases CVE-2023-29195GHSA-pqj7-jx24-wj7w

Vitess VTAdmin users that can create shards can deny access to other functions

Priority LOW 22CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00983 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vitess (vitessio): 16.0.2vitess.io/vitess (Go): 0.16.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagevitessbefore 16.0.216.0.2Patch availableCNA
—vitess.io/vitess (Go)before 0.16.20.16.2Patch availableGHSA-pqj7-jx24-wj7w
  • vitess Vendorbackstage Affected before 16.0.2 Fixed in 16.0.2 Patch available CNA
  • vitess.io/vitess (Go) Vendor— Affected before 0.16.2 Fixed in 0.16.2 Patch available GHSA-pqj7-jx24-wj7w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:*before 16.0.2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:* Versions before 16.0.2 Vulnerable ·backstage

Remediation

  • Fix · CNA vitess (vitessio) Fixed in 16.0.2
  • Fix · GHSA-pqj7-jx24-wj7w vitess.io/vitess (Go) Fixed in 0.16.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29195
  2. 2026-10-03 Alias added: GHSA-pqj7-jx24-wj7w

References

Exploit 1

Patch 2

Advisory 2

Other 3

  • TI-2026-22308 Vitess users with backup storage access can gain unauthorized access to production deployment environments CVSS 4.0HIGH 8.4
  • TI-2026-46986 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data CVSS 3.1MEDIUM 5.3
  • TI-2026-73584 Reflected cross-site scripting in Vitess vttablet /twopcz endpoint CVSS 3.1CRITICAL 9.8
  • TI-2026-22312 Vitess users with backup storage access can write to arbitrary file paths on restore CVSS 4.0CRITICAL 9.3
  • TI-2023-13622 vitess allows users to create keyspaces that can deny access to already existing keyspaces CVSS 3.1MEDIUM 4.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences