CVE-2026-27965: Vitess command injection via tampered backup manifests

Overview

CVE-2026-27965 affects Vitess, a database clustering system for horizontal scaling of MySQL. According to the GitHub advisory and the record, the issue concerns backup manifest files that can be modified by a party with read/write access to the backup storage location, such as an S3 bucket. The record classifies the weakness as OS command injection (CWE-78).

Impact

• The record states that a manipulated manifest can cause arbitrary code to run when the affected backup is restored.
• The record states this may give an attacker unintended or unauthorized access to the production deployment environment, including information available there and the ability to run additional commands.
• The NVD CVSS 3.1 base score is 9.9 (critical). The GitHub CNA score is 8.4 under CVSS 4.0. The SSVC technical impact is recorded as total.

Affected products and versions

• Linuxfoundation Vitess: before 22.0.4, and from 23.0.0 up to before 23.0.3.
• Vitessio Vitess: before 22.0.4, and from 23.0.0 up to before 23.0.3.
• Fixed in 22.0.4 and 23.0.3, according to the record.

Exploitation status

• The CISA KEV catalog does not list this CVE in the record.
• No confirmed exploitation in the wild appears in the sources consulted.
• The SSVC exploitation value in the record is recorded as proof of concept, and the EPSS probability is 0.704 percent. These are risk indicators, not evidence of attacks.

Remediation and mitigation

• Upgrade to 22.0.4 for the 22.x line, or to 23.0.3 for the 23.x line, as indicated by the patch references.
• If patching cannot be done immediately, the record describes a workaround: when an external decompressor is intended, set the --external-decompressor flag on vttablet and vtbackup to that decompressor, which overrides values in the manifest. When no decompressor is intended, set the flag to a harmless value such as cat or tee.
• Restrict write access to backup storage to the minimum necessary identities, and treat backup storage as a trust boundary.

Detection guidance

• Audit write operations and changes to objects in backup storage locations, especially to backup manifest files.
• Review the configuration of --external-decompressor on vttablet and vtbackup for unexpected values.
• Monitor restore operations for unexpected process execution or unexpected outbound activity from database hosts.

Limitations of the available information

• The record does not describe the exact manifest fields or the internal code path involved, and this analysis does not add those details.
• The record does not provide a separate CVE-level statement on whether other Vitess releases outside the listed ranges are affected.
• The EPSS entry carries a date of 2026-10-23, which is later than the published date, and its meaning should be verified against the EPSS source.
• Whether any deployment has already been compromised cannot be determined from the sources consulted.

Frequently asked questions

Which Vitess versions are affected by CVE-2026-27965?

According to the record, Vitess versions before 22.0.4 and from 23.0.0 up to before 23.0.3 are affected.

Is this vulnerability known to be actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation in the wild appears in the sources consulted.

What should administrators do first?

Upgrade to 22.0.4 or 23.0.3 depending on the release line. If that is not possible right away, review the --external-decompressor setting on vttablet and vtbackup as described in the record, and restrict write access to backup storage.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.