CVE-2023-29195 Vitess VTAdmin users that can create shards can deny access to other functions
Users with shard creation privileges can cause denial of service in VTAdmin by creating shards with invalid characters, blocking further shard creation and keyspace viewing.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-29195?
CVE-2023-29195 is a medium-severity denial of service vulnerability in vitessio vitess, published on 11 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.
Which versions are affected by CVE-2023-29195?
2 open source packages ship an affected version, including vitess.io/vitess. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vitess.io/vitess Go | All versions | 0.16.2 |
vitess.io/vitess Go | All versions | 0.16.2 |
Products include Linuxfoundation Vitess.
How do I fix CVE-2023-29195?
Upgrade vitess.io/vitess to 0.16.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-29195 being exploited?
There is no known exploitation of CVE-2023-29195 in the wild and no public exploit code.
Other vulnerabilities in vitessio vitess
- CVE-2026-104252 Vitess vttablet /twopcz reflected XSS
- CVE-2026-27969 Vitess users with backup storage access can write to arbitrary file paths on restore
- CVE-2026-27965 Vitess users with backup storage access can gain unauthorized access to production deployment environments
- CVE-2023-29194 vitess allows users to create keyspaces that can deny access to already existing keyspaces
Sources
Also known as AZL-26696, GHSA-pqj7-jx24-wj7w.