{"id":"CVE-2023-29194","aliases":["GHSA-735r-hv67-g38f","GO-2023-1717"],"title":"vitess allows users to create keyspaces that can deny access to already existing keyspaces","summary":"vitess allows users to create keyspaces that can deny access to already existing keyspaces","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L","vendor":"vitess","product":"vitess.io/vitess","ecosystem":"go","affected":["vitess.io/vitess < 0.16.1"],"patched":["vitess.io/vitess 0.16.1"],"published":"2023-04-11","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:53.523591945Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-735r-hv67-g38f","references":[{"url":"https://github.com/vitessio/vitess/security/advisories/GHSA-735r-hv67-g38f"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29194"},{"url":"https://github.com/vitessio/vitess/commit/adf10196760ad0b3991a7aa7a8580a544e6ddf88"},{"url":"https://github.com/vitessio/vitess"},{"url":"https://github.com/vitessio/vitess/commits/v0.16.1"}],"tags":["osv","go"],"epss":0.00782,"epssPercentile":0.54523,"ingestedAt":"2026-09-12T03:13:01.761Z","slug":"CVE-2023-29194","body":"## Overview\n\n### Impact\nUsers can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error.\nNote that all other keyspaces can still be administered using the CLI (vtctldclient).\n\n### Patches\nv16.0.1 (corresponding to 0.16.1 on pkg.go.dev)\n\n### Workarounds\nDelete the offending keyspace using a CLI client (vtctldclient) \n```\nvtctldclient --server ... DeleteKeyspace a/b\n```\n\nFound during a security audit sponsored by the [CNCF](https://cncf.io) and facilitated by [OSTIF](https://ostif.org).\n\n## Affected packages\n\n- `vitess.io/vitess < 0.16.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `vitess.io/vitess 0.16.1`","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}