‹ Back to list

CVE-2026-104252

Status: Awaiting AnalysisCritical (9.8)—
Severity9.8Critical · CVSS 3.1
Exploitation probability0.89 %higher than 59% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

CVSS

Base score
9.8
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.89 %
Percentile among all scored CVEs
59
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Inferred by deterministic rules from the CVSS vector and CWE. Indicative only.

ATT&CK mitigations that cover these techniques

Vulnerability ScanningRestrict Web-Based ContentPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network Traffic

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linuxfoundation — VitessAI

CWEs

References

Show 9 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-104252",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-104252",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-15T13:23:55.916133Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "vitessio",
          "product": "vitess",
          "versions": [
            {
              "status": "affected",
              "version": "< 23.0.5"
            },
            {
              "status": "affected",
              "version": ">= 24.0.0, < 24.0.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-13T20:17:12.453",
  "references": [
    {
      "url": "https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitessio/vitess/pull/20255",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitessio/vitess/pull/20273",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitessio/vitess/pull/20274",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitessio/vitess/releases/tag/v23.0.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitessio/vitess/releases/tag/v24.0.2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2."
    }
  ],
  "lastModified": "2026-10-16T16:00:33.533",
  "sourceIdentifier": "security-advisories@github.com"
}