CVE-2026-27965

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. Some workarounds are available. Those who intended to use an external decompressor then can always specify that decompressor command in the `--external-decompressor` flag value for `vttablet` and `vtbackup`. That then overrides any value specified in the manifest file. Those who did not intend to use an external decompressor, nor an internal one, can specify a value such as `cat` or `tee` in the `--external-decompressor` flag value for `vttablet` and `vtbackup` to ensure that a harmless command is always used.

• CWE-78

• https://github.com/vitessio/vitess/commit/4c0173293907af9cb942a6683c465c3f1e9fdb5cPatch
• https://github.com/vitessio/vitess/issues/19459Issue Tracking
• https://github.com/vitessio/vitess/pull/19460Issue Tracking, Patch
• https://github.com/vitessio/vitess/security/advisories/GHSA-8g8j-r87h-p36xMitigation, Patch, Vendor Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2796JIT miscompilation in the JavaScript: WebAssembly component.…9.8
• CVE-2026-27960OpenCTI is an open source platform for managing cyber threat…9.8
• CVE-2026-27961Agenta is an open-source LLMOps platform. A Server-Side Temp…8.8
• CVE-2026-27962Authlib is a Python library which builds OAuth and OpenID Co…9.1
• CVE-2026-27963Audiobookshelf is a self-hosted audiobook and podcast server…4.8
• CVE-2026-27964FacturaScripts is an open source accounting and invoicing so…3.9
• CVE-2026-27966Langflow is a tool for building and deploying AI-powered age…9.8
• CVE-2026-27967Zed, a code editor, has a symlink escape vulnerability in ve…7.1
• CVE-2026-27968Packistry is a self-hosted Composer repository designed to h…4.3
• CVE-2026-27969Vitess is a database clustering system for horizontal scalin…8.8
• CVE-2026-2797Use-after-free in the JavaScript: GC component. This vulnera…9.8
• CVE-2026-27970Angular is a development platform for building mobile and de…6.1