CVE-2026-27969: Vitess users with backup storage access can write to arbitrary file paths on restore
Impact
Anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — which may be files that they have also added to the manifest and backup contents — are written to any accessible location on restore. This is a common Path Traversal security issue. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there.
Patches
v23.0.3 and v22.0.4
Resources
https://github.com/vitessio/vitess/pull/19470
Other sources
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — which may be files that they have also added to the manifest and backup contents — are written to any accessible location on restore. This is a common path traversal security issue. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. No known workarounds are available.
— MITRE
Vitess users with backup storage access can write to arbitrary file paths on restore
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27969?
CVE-2026-27969 has been classified as a high-severity vulnerability due to the potential for unauthorized file manipulation during backup restoration.
How do I fix CVE-2026-27969?
To fix CVE-2026-27969, upgrade to Vitess version 23.0.3 or 22.0.4 or later.
Who is affected by CVE-2026-27969?
Users of Vitess versions prior to 23.0.3 and 22.0.4 with backup storage access are affected by CVE-2026-27969.
What type of vulnerability is CVE-2026-27969?
CVE-2026-27969 is a file write vulnerability allowing unauthorized access to backup files.
What systems or storage are impacted by CVE-2026-27969?
CVE-2026-27969 impacts systems using Vitess with backup storage solutions like S3 buckets.