CVE-2022-31011

    Dashboard / Vulnerabilities / CVE-2022-31011

    CVE-2022-31011

    Published: 31 May 2022Last Modified: 12 Aug 2026

    Summary: TiDB authentication bypass vulnerability

    Details: TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. TiDB version 5.3.1 contains a patch for this issue. Other mitigation strategies include turning off Security Enhanced Mode (SEM), disabling local login for non-root accounts, and ensuring that the same IP cannot be logged in as root and normal user at the same time.

    References: https://github.com/pingcap/tidb/releases/tag/v5.3.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31011.json, https://github.com/pingcap/tidb/security/advisories/GHSA-4whx-7p29-mq22, https://nvd.nist.gov/vuln/detail/CVE-2022-31011

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4a1b2e9fe5b5afb1068c56de47adb07098d768d6
    Fixed -459917c6f83df155edcc03f6ebde24942ff73b0e

    Affected versions

    5.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31011 | CVE-DB