{"api_version":"1","generated_at":"2026-10-14T19:24:05+00:00","cve":"CVE-2026-104252","urls":{"html":"https://cve.report/CVE-2026-104252","api":"https://cve.report/api/cve/CVE-2026-104252.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-104252","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-104252"},"summary":{"title":"Vitess vttablet /twopcz reflected XSS","description":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-10-13 20:17:12","updated_at":"2026-10-13 20:17:12"},"problem_types":["CWE-79","CWE-79 CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8","name":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af","name":"https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2","name":"https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/vitessio/vitess/pull/20255","name":"https://github.com/vitessio/vitess/pull/20255","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/vitessio/vitess/releases/tag/v24.0.2","name":"https://github.com/vitessio/vitess/releases/tag/v24.0.2","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/vitessio/vitess/pull/20273","name":"https://github.com/vitessio/vitess/pull/20273","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/vitessio/vitess/pull/20274","name":"https://github.com/vitessio/vitess/pull/20274","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/vitessio/vitess/releases/tag/v23.0.5","name":"https://github.com/vitessio/vitess/releases/tag/v23.0.5","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7","name":"https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104252","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104252","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"vitessio","product":"vitess","version":"affected < 23.0.5","platforms":[]},{"source":"CNA","vendor":"vitessio","product":"vitess","version":"affected >= 24.0.0, < 24.0.2","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"vitess","vendor":"vitessio","versions":[{"status":"affected","version":"< 23.0.5"},{"status":"affected","version":">= 24.0.0, < 24.0.2"}]}],"descriptions":[{"lang":"en","value":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-13T19:22:58.208Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8","tags":["x_refsource_CONFIRM"],"url":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8"},{"name":"https://github.com/vitessio/vitess/pull/20255","tags":["x_refsource_MISC"],"url":"https://github.com/vitessio/vitess/pull/20255"},{"name":"https://github.com/vitessio/vitess/pull/20273","tags":["x_refsource_MISC"],"url":"https://github.com/vitessio/vitess/pull/20273"},{"name":"https://github.com/vitessio/vitess/pull/20274","tags":["x_refsource_MISC"],"url":"https://github.com/vitessio/vitess/pull/20274"},{"name":"https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2","tags":["x_refsource_MISC"],"url":"https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2"},{"name":"https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af","tags":["x_refsource_MISC"],"url":"https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af"},{"name":"https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7","tags":["x_refsource_MISC"],"url":"https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7"},{"name":"https://github.com/vitessio/vitess/releases/tag/v23.0.5","tags":["x_refsource_MISC"],"url":"https://github.com/vitessio/vitess/releases/tag/v23.0.5"},{"name":"https://github.com/vitessio/vitess/releases/tag/v24.0.2","tags":["x_refsource_MISC"],"url":"https://github.com/vitessio/vitess/releases/tag/v24.0.2"}],"source":{"advisory":"GHSA-v75v-6fpf-gvw8","discovery":"UNKNOWN"},"title":"Vitess vttablet /twopcz reflected XSS"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-104252","datePublished":"2026-10-13T19:22:58.208Z","dateReserved":"2026-10-01T19:04:39.706Z","dateUpdated":"2026-10-13T19:22:58.208Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-13 20:17:12","lastModifiedDate":"2026-10-13 20:17:12","problem_types":["CWE-79","CWE-79 CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"104252","Ordinal":"1","Title":"Vitess vttablet /twopcz reflected XSS","CVE":"CVE-2026-104252","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"104252","Ordinal":"1","NoteData":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","Type":"Description","Title":"Vitess vttablet /twopcz reflected XSS"}]}}}