CVE-2023-29195

Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.

• CWE-20
• CWE-703

• https://github.com/vitessio/vitess/commit/9dcbd7de3180f47e94f54989fb5c66daea00c920Patch
• https://github.com/vitessio/vitess/issues/12842Exploit, Issue Tracking, Patch
• https://github.com/vitessio/vitess/pull/12843Issue Tracking, Patch
• https://github.com/vitessio/vitess/releases/tag/v16.0.2Release Notes
• https://github.com/vitessio/vitess/security/advisories/GHSA-pqj7-jx24-wj7wMitigation, Vendor Advisory
• https://pkg.go.dev/vitess.io/vitess@v0.16.2Product
• https://github.com/vitessio/vitess/commit/9dcbd7de3180f47e94f54989fb5c66daea00c920Patch
• https://github.com/vitessio/vitess/issues/12842Exploit, Issue Tracking, Patch
• https://github.com/vitessio/vitess/pull/12843Issue Tracking, Patch
• https://github.com/vitessio/vitess/releases/tag/v16.0.2Release Notes
• https://github.com/vitessio/vitess/security/advisories/GHSA-pqj7-jx24-wj7wMitigation, Vendor Advisory
• https://pkg.go.dev/vitess.io/vitess@v0.16.2Product

Published

May 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29188SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4F…5.4
• CVE-2023-29189SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, …5.4
• CVE-2023-2919The Tutor LMS plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2023-29192SilverwareGames.io versions before 1.2.19 allow users with a…4.3
• CVE-2023-29193SpiceDB is an open source, Google Zanzibar-inspired, databas…7.5
• CVE-2023-29194Vitess is a database clustering system for horizontal scalin…2.7
• CVE-2023-29196Discourse is an open source platform for community discussio…6.1
• CVE-2023-29197guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…7.5
• CVE-2023-29198Electron is a framework which lets you write cross-platform …8.5
• CVE-2023-29199There exists a vulnerability in source code transformer (exc…10
• CVE-2023-2920Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-29200Contao is an open source content management system. Prior to…6.5