{"id":"CVE-2023-29195","aliases":["GHSA-pqj7-jx24-wj7w"],"url":"https://o3.security/vulnerability/CVE-2023-29195","summary":"Vitess VTAdmin users that can create shards can deny access to other functions","details":"### Impact\nUsers can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. \nAttempting to view the keyspace(s) will also no longer work.\nCreating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly.\n\n### Patches\nv16.0.2, corresponding to [0.16.2 on pkg.go.dev](https://pkg.go.dev/vitess.io/vitess@v0.16.2)\n\n### Workarounds\n- Always use `vtctldclient` to create shards, instead of using VTAdmin\n- Disable creating shards from VTAdmin using RBAC\n- Delete the topology record for the offending shard using the client for your topology server. For example, if you created a shard called `a/b` in keyspace `commerce`, and you are running etcd, it can be deleted by doing something like\n```\n% etcdctl --endpoints \"http://${ETCD_SERVER}\" del /vitess/global/keyspaces/commerce/shards/a/b/Shard\n```\n\n### References\nhttps://github.com/vitessio/vitess/issues/12842\n\nFound during a security audit sponsored by the [CNCF](https://cncf.io) and facilitated by [OSTIF](https://ostif.org).","published":"2023-05-11T19:07:39.530Z","modified":"2026-08-12T03:51:17.627041609Z","cvss":{"score":4.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Go","name":"vitess.io/vitess","fixedVersion":"0.16.2"}],"fix":{"url":"https://github.com/vitessio/vitess/commit/9dcbd7de3180f47e94f54989fb5c66daea00c920","label":"vitessio/vitess@9dcbd7d"},"references":[{"type":"WEB","url":"https://github.com/vitessio/vitess/releases/tag/v16.0.2"},{"type":"WEB","url":"https://pkg.go.dev/vitess.io/vitess@v0.16.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29195.json"},{"type":"ADVISORY","url":"https://github.com/vitessio/vitess/security/advisories/GHSA-pqj7-jx24-wj7w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29195"},{"type":"REPORT","url":"https://github.com/vitessio/vitess/issues/12842"},{"type":"FIX","url":"https://github.com/vitessio/vitess/commit/9dcbd7de3180f47e94f54989fb5c66daea00c920"},{"type":"FIX","url":"https://github.com/vitessio/vitess/pull/12843"},{"type":"PACKAGE","url":"https://github.com/vitessio/vitess"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:17.627041609Z"}}