{"schemaVersion":3,"id":"CVE-2026-104252","aliases":["GHSA-v75v-6fpf-gvw8","CGA-233c-qcgr-7vg5","CGA-25q9-vjvh-mf9h","CGA-29xx-phrf-2xfc","CGA-2q64-93cq-wxpc","CGA-2xjg-qxvv-7f92","CGA-322p-2hhp-gjxm","CGA-342p-53vc-jg78","CGA-35qj-7gx5-r657","CGA-3742-9h83-r2rh","CGA-3929-rm2h-g379","CGA-39m2-v2x2-qvc9","CGA-3wg8-j89p-f2h4","CGA-429f-98v3-rv9x","CGA-4cwv-6w24-8f2v","CGA-4m23-fh93-4qvr","CGA-4m4r-r322-vch5","CGA-4ph4-q7r2-6723","CGA-53cp-fggj-v74p","CGA-597g-r6mc-v2xp","CGA-5g49-5hrj-6675","CGA-5h3m-fj7m-wpv3","CGA-5qxm-6rc8-vvrm","CGA-5v29-4qvc-5pm4","CGA-5w4m-9jmg-fgvh","CGA-65vf-q388-6w92","CGA-66pf-cjvr-2p84","CGA-67h9-c5gj-582x","CGA-67j6-9cwq-8j94","CGA-67v5-q588-fq3q","CGA-728q-76m3-28gj","CGA-744q-jw69-2vx6","CGA-78xw-j5qx-g5hp","CGA-79f3-46x7-47mm","CGA-79w6-7365-f8qj","CGA-7f9c-85xg-73jm","CGA-822v-69c4-m8xj","CGA-8336-prfv-cx53","CGA-8p49-mpw8-xc2f","CGA-8pfj-737r-p528","CGA-8qhp-h8c9-mpmv","CGA-924j-wwp7-xcpq","CGA-936x-8r8v-4qx4","CGA-93hw-jqcw-2pfh","CGA-942x-wqcv-qjcc","CGA-9hw6-v5c5-m96r","CGA-cvvv-9ghq-42xv","CGA-f59w-34qg-jhjh","CGA-f9p3-5c42-6x46","CGA-f9vq-97x6-8222","CGA-fjjw-g29x-683p","CGA-fq2r-723h-jrjf","CGA-fr28-gmqf-q58v","CGA-g44j-4vqx-w83q","CGA-g8g5-6982-rxf4","CGA-gcgr-xhr5-73vj","CGA-gcq3-hpmx-2f5m","CGA-grjv-52mv-4gv6","CGA-gv2x-c7vg-6gj6","CGA-gvmr-w6wj-9pr6","CGA-h264-gfr8-mrr8","CGA-h6wc-g25c-8345","CGA-jhvh-pqg9-rx9q","CGA-jjcv-6pxp-7rp2","CGA-jpj9-qfgp-f3gm","CGA-jq5g-jxgr-8jc6","CGA-jrhf-x7cq-jw44","CGA-mf9f-q99r-v86f","CGA-mmmh-c34h-jv3p","CGA-p29f-5665-2vqp","CGA-p2rp-72q9-5hm4","CGA-p3pr-5mj5-v84w","CGA-p4hj-q8qw-x4jg","CGA-p732-c53j-5j5g","CGA-p97m-qf55-x547","CGA-pm6f-3pr3-v86c","CGA-pp92-c54m-g4xr","CGA-prhp-7mff-59xr","CGA-pv7x-jq5g-c25f","CGA-q6j6-cq2q-46hr","CGA-qj97-j3vj-456h","CGA-qjwj-59xj-cqjc","CGA-qwf4-fcr6-vjc9","CGA-qxhp-rmpq-355p","CGA-r49h-qg6q-44f2","CGA-r8xv-32v3-jv49","CGA-rg83-45h6-7mr2","CGA-rqmh-fq97-2jhv","CGA-rwwj-476m-wvwr","CGA-v6rh-7597-vgc4","CGA-vp37-4777-h7m8","CGA-vpxm-95mm-x3mx","CGA-vq2q-m5qw-xv4g","CGA-vxjg-8qph-92cf","CGA-w29x-f67g-f63j","CGA-w5qv-c7p2-725x","CGA-w7m7-87jh-747w","CGA-w9p7-vc7m-rmrf","CGA-wprc-v322-r7v8","CGA-x32j-4w4p-9v5c","CGA-x4qh-4q65-458h","CGA-x4vr-wr32-wm3g","CGA-xrgp-5v5p-8qrm","CGA-xv7f-5wx9-9634","CGA-xw6f-3942-f39h","CGA-xxv5-vgj9-m6g9","CGA-qf48-r3h8-jfg9"],"status":"published","duplicateOf":null,"title":null,"description":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","dates":{"published":"2026-10-13T19:22:58.208Z","modified":"2026-10-15T15:11:35.194Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true}]},"epss":{"probability":0.00885,"percentile":0.58616,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-14T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00885,"percentile":0.58616}],"last30":[{"date":"2026-10-14T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00885,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00885,"percentile":0.58616}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22-binaries","name":"vitess-22-binaries","label":"vitess-22-binaries","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22-binaries","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"vitess.io","product":"vitess","name":"vitess.io/vitess","label":"vitess","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/vitess.io/vitess","purlType":"golang","versions":[{"text":"< 0.23.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.24.0, < 0.24.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.23.5 | ≥ 0.24.0, < 0.24.2","eol":null,"hubHref":null},{"vendor":"vitessio","product":"vitess","name":"vitess","label":"vitess","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 23.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 24.0.0, < 24.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.5 | ≥ 24.0.0, < 24.0.2","eol":null,"hubHref":"/vendor/vitessio/vitess"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8","label":"github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory"]},{"url":"https://github.com/vitessio/vitess/pull/20255","label":"github.com/vitessio/vitess/pull/20255","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/vitessio/vitess/pull/20273","label":"github.com/vitessio/vitess/pull/20273","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/vitessio/vitess/pull/20274","label":"github.com/vitessio/vitess/pull/20274","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2","label":"github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af","label":"github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7","label":"github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/vitessio/vitess/releases/tag/v23.0.5","label":"github.com/vitessio/vitess/releases/tag/v23.0.5","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://github.com/vitessio/vitess/releases/tag/v24.0.2","label":"github.com/vitessio/vitess/releases/tag/v24.0.2","hostname":"github.com","tags":["X Refsource MISC","WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104252","label":"nvd.nist.gov/vuln/detail/CVE-2026-104252","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/vitessio/vitess","label":"github.com/vitessio/vitess","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104252.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104252.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-13T19:22:58.208Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-15T15:11:35.194Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T13:37:45.891Z","stale":false,"partial":false}}