{"id":"CVE-2023-29195","aliases":["AZL-26696","EUVD-2023-1601","GHSA-pqj7-jx24-wj7w"],"status":"published","title":"Vitess VTAdmin users that can create shards can deny access to other functions","description":"Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00983,"percentile":0.62746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-703"],"published":"2023-05-11T19:07:39Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"Go","package":"vitess.io/vitess","fixed_in":["0.16.2"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"vitess","fixed_in":["16.0.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"vitess.io/vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.2-1"}]}]},{"source":"osv","ecosystem":"Go","package":"vitess.io/vitess","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.16.2"}]}]}],"products":[{"vendor":"linuxfoundation","product":"vitess"},{"vendor":"vitessio","product":"vitess"}],"references":[{"url":"https://github.com/vitessio/vitess/security/advisories/GHSA-pqj7-jx24-wj7w","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vitessio/vitess/issues/12842","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","report","web"]},{"url":"https://github.com/vitessio/vitess/pull/12843","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/vitessio/vitess/commit/9dcbd7de3180f47e94f54989fb5c66daea00c920","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/vitessio/vitess/releases/tag/v16.0.2","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://pkg.go.dev/vitess.io/vitess@v0.16.2","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29195","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pqj7-jx24-wj7w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29195.json","tags":["advisory"]},{"url":"https://github.com/vitessio/vitess","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-29195","title":"Vitess VTAdmin users that can create shards can deny access to other functions","description":"Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.","status":"published","published":"2023-05-11T19:07:39.53Z","modified":"2025-01-24T21:28:41.799Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-20","CWE-703"],"updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-1601","description":"Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.","status":"published","published":"2023-05-11T19:07:39Z","modified":"2025-01-24T21:28:41Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:13.087176Z"}],"ghsa":[{"id":"GHSA-pqj7-jx24-wj7w","title":"VTAdmin users that can create shards can deny access to other functions","description":"### Impact\nUsers can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. \nAttempting to view the keyspace(s) will also no longer work.\nCreating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly.\n\n### Patches\nv16.0.2, corresponding to [0.16.2 on pkg.go.dev](https://pkg.go.dev/vitess.io/vitess@v0.16.2)\n\n### Workarounds\n- Always use `vtctldclient` to create shards, instead of using VTAdmin\n- Disable creating shards from VTAdmin using RBAC\n- Delete the topology record for the offending shard using the client for your topology server. For example, if you created a shard called `a/b` in keyspace `commerce`, and you are running etcd, it can be deleted by doing something like\n```\n% etcdctl --endpoints \"http://${ETCD_SERVER}\" del /vitess/global/keyspaces/commerce/shards/a/b/Shard\n```\n\n### References\nhttps://github.com/vitessio/vitess/issues/12842\n\nFound during a security audit sponsored by the [CNCF](https://cncf.io) and facilitated by [OSTIF](https://ostif.org).","status":"published","published":"2023-05-11T19:40:49Z","modified":"2023-11-11T05:01:44Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20","CWE-703"],"updated_at":"2026-11-02T14:37:19.438667Z"}],"nvd":[{"id":"CVE-2023-29195","description":"Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.","status":"published","published":"2023-05-11T20:15:09.403Z","modified":"2026-06-17T05:49:35.05Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-703"],"updated_at":"2026-11-02T14:08:02.399327Z"}],"osv":[{"id":"AZL-26696","title":"CVE-2023-29195 affecting package vitess for versions less than 16.0.2-1","description":"Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.","status":"published","published":"2023-05-11T20:15:09Z","modified":"2026-04-21T04:23:46.673222Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"CVE-2023-29195","title":"Vitess VTAdmin users that can create shards can deny access to other functions","description":"Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. Attempting to view the keyspace(s) will also no longer work. Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly. Version 16.0.2, corresponding to version 0.16.2 of the `go` module, contains a patch for this issue. Some workarounds are available. Always use `vtctldclient` to create shards, instead of using VTAdmin; disable creating shards from VTAdmin using RBAC; and/or delete the topology record for the offending shard using the client for your topology server.","status":"published","published":"2023-05-11T19:07:39.53Z","modified":"2026-10-28T02:30:35.303694896Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20","CWE-703"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-pqj7-jx24-wj7w","title":"VTAdmin users that can create shards can deny access to other functions","description":"### Impact\nUsers can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. \nAttempting to view the keyspace(s) will also no longer work.\nCreating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly.\n\n### Patches\nv16.0.2, corresponding to [0.16.2 on pkg.go.dev](https://pkg.go.dev/vitess.io/vitess@v0.16.2)\n\n### Workarounds\n- Always use `vtctldclient` to create shards, instead of using VTAdmin\n- Disable creating shards from VTAdmin using RBAC\n- Delete the topology record for the offending shard using the client for your topology server. For example, if you created a shard called `a/b` in keyspace `commerce`, and you are running etcd, it can be deleted by doing something like\n```\n% etcdctl --endpoints \"http://${ETCD_SERVER}\" del /vitess/global/keyspaces/commerce/shards/a/b/Shard\n```\n\n### References\nhttps://github.com/vitessio/vitess/issues/12842\n\nFound during a security audit sponsored by the [CNCF](https://cncf.io) and facilitated by [OSTIF](https://ostif.org).","status":"published","published":"2023-05-11T19:40:49Z","modified":"2026-09-10T03:49:53.749637766Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20","CWE-703"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}