{"id":"EUVD-2026-100525","enisaUuid":"22a42939-7e6a-3f7a-b0a1-12f4a208e0dd","description":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator\u0027s browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","datePublished":"Oct 13, 2026, 7:22:58 PM","dateUpdated":"Oct 15, 2026, 3:11:35 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8\nhttps://github.com/vitessio/vitess/pull/20255\nhttps://github.com/vitessio/vitess/pull/20273\nhttps://github.com/vitessio/vitess/pull/20274\nhttps://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2\nhttps://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af\nhttps://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7\nhttps://github.com/vitessio/vitess/releases/tag/v23.0.5\nhttps://github.com/vitessio/vitess/releases/tag/v24.0.2\n","aliases":"CVE-2026-104252\nGHSA-v75v-6fpf-gvw8\n","assigner":"GitHub_M","epss":1.17,"enisaIdProduct":[{"id":"8ddd5cae-2b2b-3c8c-bf9b-2807079ab28d","product":{"name":"vitess","vendor":{"name":"vitessio"}},"product_version":"\u003c 23.0.5"},{"id":"b190f6ea-3937-31a1-a4bb-7d96daa3bb6f","product":{"name":"vitess","vendor":{"name":"vitessio"}},"product_version":"24.0.0, \u003c 24.0.2"}],"enisaIdVendor":[{"id":"a37f2fc5-bcb9-36b3-8bb6-721cd97bfbd4","vendor":{"name":"vitessio"}}],"enisaIdVulnerability":[{"id":"9ee103ec-12d4-3321-a786-66f7503b89e6","vulnerability":{"id":"CVE-2026-104252","description":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator\u0027s browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","datePublished":"Oct 13, 2026, 7:22:58 PM","dateUpdated":"Oct 15, 2026, 3:11:35 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8\nhttps://github.com/vitessio/vitess/pull/20255\nhttps://github.com/vitessio/vitess/pull/20273\nhttps://github.com/vitessio/vitess/pull/20274\nhttps://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2\nhttps://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af\nhttps://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7\nhttps://github.com/vitessio/vitess/releases/tag/v23.0.5\nhttps://github.com/vitessio/vitess/releases/tag/v24.0.2\n","enisa_id":"EUVD-2026-100525\n","assigner":"GitHub_M","epss":1.17,"dataProcessed":"Nov 2, 2026, 7:16:36 AM","vulnerabilityProduct":[{"id":"96dd6588-1c65-3175-bcb3-edb141e81090","product":{"name":"vitess","vendor":{"name":"vitessio"}},"product_version":"\u003c 23.0.5"},{"id":"c151ed2f-bc2a-3064-b01b-389eb133e879","product":{"name":"vitess","vendor":{"name":"vitessio"}},"product_version":"24.0.0, \u003c 24.0.2"}],"vulnerabilityVendor":[{"id":"f0fcdbc9-e6bf-3a2c-91ae-c78b9826864b","vendor":{"name":"vitessio"}}]}},{"id":"a60da7be-cd90-30d4-bf47-6e440e032fd7","vulnerability":{"id":"GHSA-v75v-6fpf-gvw8","description":"Vitess vttablet /twopcz reflected XSS","datePublished":"Oct 15, 2026, 8:16:29 PM","dateUpdated":"Oct 15, 2026, 8:16:29 PM","baseScore":0.0,"references":"https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104252\nhttps://github.com/vitessio/vitess/pull/20255\nhttps://github.com/vitessio/vitess/pull/20273\nhttps://github.com/vitessio/vitess/pull/20274\nhttps://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2\nhttps://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af\nhttps://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7\nhttps://github.com/vitessio/vitess\nhttps://github.com/vitessio/vitess/releases/tag/v23.0.5\nhttps://github.com/vitessio/vitess/releases/tag/v24.0.2\n","enisa_id":"EUVD-2026-100525\n","aliases":"CVE-2026-104252\nGHSA-v75v-6fpf-gvw8\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"b5ce895e-fba6-3a2a-91f9-2360e177f4c0","advisory":{"id":"msrc_CVE-2026-104252","description":"Vitess vttablet /twopcz reflected XSS","datePublished":"Oct 15, 2026, 1:09:43 AM","dateUpdated":"Oct 30, 2026, 1:44:05 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-104252.json\n","aliases":"CVE-2026-104252\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"06acdf81-34ec-3733-aef1-98b694f5e9b6","product":{"name":"vitess","vendor":{"name":"vitessio"}}},{"id":"a1899596-dffd-3e8f-bf79-4bd017abeb6f","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"ba8a4bb2-1dc6-377e-a702-032f7c659ca9","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"f680846a-78a3-32d1-8867-645bc980de3d","product":{"name":"azl3 vitess 0:19.0.4-14.azl3","vendor":{"name":"Microsoft"}}}]}}]}