Releases

Check if affected (2)

• securitycriticalBackup restore path traversal protection

  Applies if you use backup storage.

  Vitess now prevents a common Path Traversal attack in which someone with write access to backup storage modifies the MANIFEST to escape the target restore directory and write to arbitrary filesystem paths. This fix includes CVE-2026-27969 and GHSA-r492-hjgh-c9gw.

• securityhighManifest-based external decompression default, changed

  Applies if you use an external decompressor command and do not pass --external-decompressor-use-manifest.

  The external decompressor command stored in a backup's MANIFEST file is no longer used during restore by default. --external-decompressor-use-manifest restores manifest-based decompression in this release, which includes CVE-2026-27965 and GHSA-8g8j-r87h-p36x.

Check if affected (2)

• securityLoading compressor commands from MANIFEST, opt-in

  Applies if you use --external-decompressor-use-manifest.

  Restore loads compressor commands from MANIFEST only when --external-decompressor-use-manifest is used. This opt-in behavior ships in the restore path.

• securityPath traversal through backup MANIFEST on restore blocked

  Applies if backupengine runs.

  backupengine disallows path traversal through backup MANIFEST files during restore. The protection ships in the backup restore path.

Action needed (1)

• securityThe golang.org/x/crypto dependency, updated

  Vitess v23.0.1 updates golang.org/x/crypto from 0.42.0 to 0.45.0.