CVE-2023-29194

    Dashboard / Vulnerabilities / CVE-2023-29194

    CVE-2023-29194

    Published: 14 Apr 2023Last Modified: 12 Aug 2026

    Summary: vitess allows users to create keyspaces that can deny access to already existing keyspaces

    Details: Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error. Note that all other keyspaces can still be administered using the CLI (vtctldclient). This issue is fixed in version 16.0.1. As a workaround, delete the offending keyspace using a CLI client (vtctldclient).

    References: https://github.com/vitessio/vitess/commits/v0.16.1/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29194.json, https://github.com/vitessio/vitess/security/advisories/GHSA-735r-hv67-g38f, https://nvd.nist.gov/vuln/detail/CVE-2023-29194, https://github.com/vitessio/vitess/commit/adf10196760ad0b3991a7aa7a8580a544e6ddf88

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d1ba6258ea2462d5d28d67661aace7b79bb7e27b

    Affected versions

    v16.0.0
    v16.0.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-29194 | CVE-DB