PT-2026-22106 · Vitess · Vitess

Neurowinter · Published 2026-02-26 · Updated 2026-03-25 · CVE-2026-27965

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vitess versions prior to 23.0.3 Vitess versions prior to 22.0.4

Description Vitess is a database clustering system for horizontal scaling of MySQL. A flaw exists where someone with read/write access to the backup storage location can manipulate backup manifest files, leading to arbitrary code execution when the backup is restored. This could grant an attacker unintended access to the production deployment environment, allowing them to access information and execute arbitrary commands.

Recommendations Update to Vitess version 23.0.3 or later. Update to Vitess version 22.0.4 or later. If using an external decompressor, specify the decompressor command using the --external-decompressor flag for vttablet and vtbackup. If not using an external or internal decompressor, specify a harmless command such as cat or tee in the --external-decompressor flag value for vttablet and vtbackup.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

AZL-78356

AZL-78593

CVE-2026-27965

GHSA-8G8J-R87H-P36X

GO-2026-4567

SUSE-SU-2026:1042-1

Affected Products

Vitess

References · 149

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27965.json · Exploit
• https://github.com/vitessio/vitess/security/advisories/GHSA-8g8j-r87h-p36x · Vendor Advisory
• https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c · Patch
• https://github.com/vitessio/vitess/pull/19460 · Patch
• https://osv.dev/vulnerability/CVE-2026-27965 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27965 · Security Note
• https://osv.dev/vulnerability/GHSA-8g8j-r87h-p36x · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78593 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78356 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://github.com/vitessio/vitess/issues/19459 · Note
• https://github.com/vitessio/vitess · Note
• https://reddit.com/r/VulnMatter/comments/1rge3fn/resumen_diario_de_vulnerabilidades_27022026 · Reddit Post
• https://suse.com/security/cve/CVE-2026-29781 · Note