CVE-2026-27965

CVE-2026-27965 is a critical vulnerability affecting Vitess, a database clustering system for MySQL, specifically versions prior to 23.0.3 and 22.0.4. It allows an attacker with read/write access to the backup storage location to manipulate backup manifest files, leading to arbitrary code execution during backup restoration. This can grant unauthorized access to the production deployment environment, enabling data access and arbitrary command execution. Rated 9.9 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The EPSS score is very low, suggesting a low probability of exploitation in the wild. There is no evidence of active exploitation, nor is public exploit code available in Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered some community discussion, with three mentions across GitHub and Bluesky.