Vitess users with backup storage access can gain unauthorized access to production deployment environments

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L · score source

EPSS

• CVE-2026-27965: 0.47% estimated exploitation activity in the next 30 days; percentile 41.08 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact Any user with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Patches Fixes are expected to be released with versions v23.0.3 and v22.0.4 See fix commit at https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5c Workarounds If maintainers intended to use an external decompressor then they can always specify that decompressor command in the --external-decompressor flag value for vttablet and vtbackup. That then overrides any value specified in the manifest file. If maintainers did not intend to use an external decompressor, nor an internal one, then they can specify a value such as cat…

Published by the source

26 Feb 2026, 22:50 UTC

Last modified by the source

26 Feb 2026, 22:50 UTC

Source last checked

26 Oct 2026, 15:14 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-8g8j-r87h-p36x

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-27965

Advisory: Vitess users with backup storage access can gain unauthorized access to production deployment environments
IDs: CVE-2026-27965, GHSA-8g8j-r87h-p36x
Record: https://patchnext.com/advisories/cve-2026-27965 (revision 1, source checked 26 Oct 2026, 15:14 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go vitess.io/vitess: affected <= 0.23.2

## Suggested inspection (read-only)
- Go vitess.io/vitess: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on vitess.io/vitess.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-8g8j-r87h-p36x (GitHub-reviewed advisory GHSA-8g8j-r87h-p36x lists affected ranges: Go vitess.io/vitess >=0 <=0.23.2)

Commands are suggestions: review each one before running it.