CVE-2023-29194 vitess allows users to create keyspaces that can deny access to already existing keyspaces
Attackers can create keyspaces with slashes to break VTAdmin and CLI listing functions, denying visibility to other keyspaces.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-29194?
CVE-2023-29194 is a medium-severity denial of service vulnerability in vitessio vitess, published on 14 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).
Which versions are affected by CVE-2023-29194?
3 open source packages ship an affected version, including vitess.io/vitess. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vitess.io/vitess Go | All versions | 0.16.1 |
vitess.io/vitess Go | All versions | 0.16.1 |
vitess.io/vitess Go | All versions | 0.16.1 |
Products include Linuxfoundation Vitess.
How do I fix CVE-2023-29194?
Upgrade vitess.io/vitess to 0.16.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-29194 being exploited?
There is no known exploitation of CVE-2023-29194 in the wild and no public exploit code.
Other vulnerabilities in vitessio vitess
- CVE-2026-104252 Vitess vttablet /twopcz reflected XSS
- CVE-2026-27969 Vitess users with backup storage access can write to arbitrary file paths on restore
- CVE-2026-27965 Vitess users with backup storage access can gain unauthorized access to production deployment environments
- CVE-2023-29195 Vitess VTAdmin users that can create shards can deny access to other functions
Sources
Also known as AZL-26295, GHSA-735r-hv67-g38f, GO-2023-1717.