CVE-2026-104252criticalCWE-79

CVE-2026-104252: falha crítica em vitessio vitess

Vitess vttablet /twopcz reflected XSS

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar vitess+ Monitorar vitess.io/vitess

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 1.2%
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
vitessio · vitess
CVEs relacionadas — vitessio vitess

No mesmo produto, das mais perigosas para as menos.

CVE-2023-29195MEDIUMVitess VTAdmin users that can create shards can deny access to other functionsEPSS 1.0%CVE-2023-29194MEDIUMvitess allows users to create keyspaces that can deny access to already existing keyspacesEPSS 0.8%CVE-2024-32886MEDIUMVitess vulnerable to infinite memory consumption and vtgate crashEPSS 0.8%CVE-2026-27969CRITICALVitess users with backup storage access can write to arbitrary file paths on restoreEPSS 0.5%CVE-2026-27965HIGHVitess users with backup storage access can gain unauthorized access to production deployment environmentsEPSS 0.5%CVE-2024-53257MEDIUMVitess allows HTML injection in /debug/querylogz & /debug/envEPSS 0.4%