Every CVE Search/ Get API key

CVE-2023-29194

vitess allows users to create keyspaces that can deny access to already existing keyspaces

4.1 MediumFix available

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.78%Up 0.7 points since Apr 15, 2023
90%50%10%1%

What each source reports

CVE List Score used 4.1

vitess allows users to create keyspaces that can deny access to already existing keyspaces

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).

Record
CVE-2023-29194
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-20, CWE-703
Updated
2026-11-02
EUVDEUVD-2023-1221 4.1

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).

Record
EUVD-2023-1221
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-735r-hv67-g38f 4.1

vitess allows users to create keyspaces that can deny access to already existing keyspaces

Impact

Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient).

Patches

v16.0.1 (corresponding to 0.16.1 on pkg.go.dev)

Workarounds

Delete the offending keyspace using a CLI client (vtctldclient)

vtctldclient --server ... DeleteKeyspace a/b

Found during a security audit sponsored by the CNCF and facilitated by OSTIF.

Record
GHSA-735r-hv67-g38f
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-20, CWE-703
Updated
2026-11-02
NVD 4.1

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).

Record
CVE-2023-29194
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
CVSS 3.1
2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-20, CWE-703
Updated
2026-11-02
OSVAZL-26295 2.7

CVE-2023-29194 affecting package vitess for versions less than 16.0.2-1

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).

Record
AZL-26295
CVSS 3.1
2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 4.1

vitess allows users to create keyspaces that can deny access to already existing keyspaces

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).

Record
CVE-2023-29194
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-20, CWE-703
Updated
2026-11-02
OSVGHSA-735r-hv67-g38f 4.1

vitess allows users to create keyspaces that can deny access to already existing keyspaces

Impact

Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient).

Patches

v16.0.1 (corresponding to 0.16.1 on pkg.go.dev)

Workarounds

Delete the offending keyspace using a CLI client (vtctldclient)

vtctldclient --server ... DeleteKeyspace a/b

Found during a security audit sponsored by the CNCF and facilitated by OSTIF.

Record
GHSA-735r-hv67-g38f
CVSS 3.1
4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Weakness
CWE-20, CWE-703
Updated
2026-11-02
OSVGO-2023-1717 No score

Improper handling of keyspaces in vitess.io/vitess

Users can create a keyspace containing '/'. Future attempts to view keyspaces from some tools (including VTAdmin and "vtctldclient GetKeyspaces") receive an error.

Record
GO-2023-1717
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vitess.io/vitess
Go
 before 0.16.1
0.16.1
vitess
Azure Linux:2
 before 16.0.2-1
16.0.2-1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-29194 is a medium vulnerability (CVSS 4.1) in Linuxfoundation Vitess, published April 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in vitess.io/vitess 0.16.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open