CVE-2026-27969 - Vulnerability Analysis

Overview

Vitess < 23.0.3 and < 22.0.4 contains a path traversal caused by manipulation of backup manifest files in backup storage, letting attackers with read/write access to backup storage write files to arbitrary locations on restore, exploit requires read/write access to backup storage.

Severity & Score

Impact

Attackers can write files to arbitrary locations and execute arbitrary commands, leading to unauthorized access and control over the production environment.

Mitigation

Update to versions 23.0.3 or 22.0.4 or later.

References

• https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a
• https://github.com/vitessio/vitess/pull/19470
• https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 28, 2026

🟠 CVE-2026-27969 - High (8.8) Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27969/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner