PT-2026-22109 · Vitess · Vitess

Neurowinter · Published 2026-02-26 · Updated 2026-03-25 · CVE-2026-27969

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Vitess versions prior to 23.0.3 and versions prior to 22.0.4

Description Vitess, a database clustering system for horizontal scaling of MySQL, contains a path traversal issue in the builtinbackupengine component during the backup restoration process. An attacker with read/write access to the backup storage location (such as an S3 bucket) can manipulate backup manifest files. This manipulation allows them to write files to arbitrary locations during a restore operation, potentially gaining unintended or unauthorized access to the production deployment environment. This access could allow the attacker to access sensitive information and execute arbitrary commands. The vulnerability arises from improper validation of file paths within the backup manifest.

Recommendations Versions prior to 23.0.3 should be updated to version 23.0.3 or later. Versions prior to 22.0.4 should be updated to version 22.0.4 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-78359

AZL-78516

CVE-2026-27969

GHSA-R492-HJGH-C9GW

GO-2026-4570

SUSE-SU-2026:1042-1

Affected Products

Vitess

References · 152

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27969.json · Exploit
• https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a · Patch
• https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw · Vendor Advisory
• https://github.com/vitessio/vitess/pull/19470 · Patch
• https://osv.dev/vulnerability/AZL-78516 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r492-hjgh-c9gw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27969 · Security Note
• https://osv.dev/vulnerability/AZL-78359 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4570 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://github.com/vitessio/vitess · Note
• https://reddit.com/r/VulnMatter/comments/1rge3fn/resumen_diario_de_vulnerabilidades_27022026 · Reddit Post
• https://suse.com/security/cve/CVE-2026-29781 · Note
• https://suse.com/security/cve/CVE-2026-27969 · Note