CVE-2026-27969 - Vulnerability Analysis

Overview

Vitess < 23.0.3 and < 22.0.4 contains a path traversal caused by manipulation of backup manifest files in backup storage, letting attackers with read/write access to backup storage write files to arbitrary locations on restore, exploit requires read/write access to backup storage.

Severity & Score

Impact

Attackers can write files to arbitrary locations and execute arbitrary commands, leading to unauthorized access and control over the production environment.

Mitigation

Update to versions 23.0.3 or 22.0.4 or later.

References

• https://github.com/vitessio/vitess/pull/19470
• https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw
• https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a

Social Media Activity(1 post)

Offensive Sequence

@offseq

Feb 26, 2026

🔥 CRITICAL: CVE-2026-27969 in Vitess (<22.0.4, 23.0.0 – 23.0.3) allows path traversal via backup restore. Attackers w/ backup storage access can write files anywhere Vitess can reach. Patch ASAP & secure storage! https://radar.offseq.com/threat/cve-2026-27969-cwe-22-improper-limitation-of-a-pat-4b60f36b #OffSeq #Vitess #CVE202627969

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner