---
id: CVE-2023-29194
aliases:
  - GHSA-735r-hv67-g38f
  - GO-2023-1717
title: >-
  vitess allows users to create keyspaces that can deny access to already
  existing keyspaces
summary: >-
  vitess allows users to create keyspaces that can deny access to already
  existing keyspaces
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L'
vendor: vitess
product: vitess.io/vitess
ecosystem: go
affected:
  - vitess.io/vitess < 0.16.1
patched:
  - vitess.io/vitess 0.16.1
published: '2023-04-11'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:53.523591945Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-735r-hv67-g38f'
references:
  - url: 'https://github.com/vitessio/vitess/security/advisories/GHSA-735r-hv67-g38f'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-29194'
  - url: >-
      https://github.com/vitessio/vitess/commit/adf10196760ad0b3991a7aa7a8580a544e6ddf88
  - url: 'https://github.com/vitessio/vitess'
  - url: 'https://github.com/vitessio/vitess/commits/v0.16.1'
tags:
  - osv
  - go
epss: 0.00782
epssPercentile: 0.54111
ingestedAt: '2026-09-12T03:13:01.761Z'
---

## Overview

### Impact
Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error.
Note that all other keyspaces can still be administered using the CLI (vtctldclient).

### Patches
v16.0.1 (corresponding to 0.16.1 on pkg.go.dev)

### Workarounds
Delete the offending keyspace using a CLI client (vtctldclient) 
```
vtctldclient --server ... DeleteKeyspace a/b
```

Found during a security audit sponsored by the [CNCF](https://cncf.io) and facilitated by [OSTIF](https://ostif.org).

## Affected packages

- `vitess.io/vitess < 0.16.1`

## Remediation

Upgrade to a patched release:

- `vitess.io/vitess 0.16.1`