Is CVE-2026-104252 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104252 being exploited in the wild.

How severe is CVE-2026-104252?

Critical severity, with a CVSS score of 9.8, published 13 October 2026.

Which products and versions are affected?

vitess.io/vitess (Go) < 0.23.5, SEMVER:introduced=0,fixed=0.23.5, SEMVER:introduced=0,fixed=0.23.5,introduced=0.24.0,fixed=0.24.2; Vitess v20.0.0 through v24.0.1 (all released versions).

How is CVE-2026-104252 attacked?

It is attacked over the network.

Am I affected by CVE-2026-104252?

Check whether you run vitess.io/vitess (Go) or Vitess at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104252: Vitess vttablet /twopcz reflected XSS

Q: Is there a fix for CVE-2026-104252?

Yes. vitess.io/vitess (Go): upgrade to 0.23.5, 0.24.2 or later. Until then: Restrict the vttablet HTTP port (default 15999) to localhost-only access using network firewall rules or reverse proxy (nginx, envoy). Alternatively, configure a non-default ACL policy to deny unauthenticated access to debug endpoints, or use --tablet-allow-stats=false if debug endpoints are not needed for production traffic. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-104252 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-104252?

Check whether you run vitess.io/vitess (Go) or Vitess at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104252 · Severity: critical · CVSS 9.8 · Published 2026-10-13

Vitess vttablet is a database proxy that multiplexes HTTP debug endpoints on port 15999. An unauthenticated attacker can inject malicious JavaScript through URL parameters that are reflected unescaped in the HTML response, allowing same-origin access to sensitive debug endpoints that expose query logs, environment variables containing credentials, and internal statistics.

Technologies: vitess.io/vitess (Go). Vendors: Go.

Quick answers

Is CVE-2026-104252 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104252 being exploited in the wild.
How severe is CVE-2026-104252?: Critical severity, with a CVSS score of 9.8, published 13 October 2026.
Which products and versions are affected?: vitess.io/vitess (Go) < 0.23.5, SEMVER:introduced=0,fixed=0.23.5, SEMVER:introduced=0,fixed=0.23.5,introduced=0.24.0,fixed=0.24.2; Vitess v20.0.0 through v24.0.1 (all released versions).
Is there a fix for CVE-2026-104252?: Yes. vitess.io/vitess (Go): upgrade to 0.23.5, 0.24.2 or later. Until then: Restrict the vttablet HTTP port (default 15999) to localhost-only access using network firewall rules or reverse proxy (nginx, envoy). Alternatively, configure a non-default ACL policy to deny unauthenticated access to debug endpoints, or use --tablet-allow-stats=false if debug endpoints are not needed for production traffic. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104252 attacked?: It is attacked over the network.
Am I affected by CVE-2026-104252?: Check whether you run vitess.io/vitess (Go) or Vitess at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vitess.io/vitess (Go): upgrade to 0.23.5, 0.24.2 or later
```
go get vitess.io/vitess@v0.24.2
```

Restrict the vttablet HTTP port (default 15999) to localhost-only access using network firewall rules or reverse proxy (nginx, envoy). Alternatively, configure a non-default ACL policy to deny unauthenticated access to debug endpoints, or use --tablet-allow-stats=false if debug endpoints are not needed for production traffic.

Technical details

The twopczHandler in twopcz.go reflects the Action and dtid form parameters directly into the HTML response via fmt.Fprintln() without HTML escaping, and serves the response as text/html with allow-all ACL policy. An attacker can craft a URL containing script tags or event handlers that execute in the operator's browser context, granting same-origin access to unauthenticated debug endpoints like /queryz, /querylogz, /txlogz, /debug/env, and /debug/vars. The bug has existed in all released versions since v20.0.0; the fix is only present in the main branch.

Affected products

Vitess Vitess v20.0.0 through v24.0.1 (all released versions)

Identifiers

CVE-2026-104252
GHSA-v75v-6fpf-gvw8
GO-2026-6798

Timeline

2026-06-24: disclosed: Security report submitted to security@vitess.io
2026-06-09: patched: Fix committed to main branch (PR #20255, commit 3140c1846c) - not released
2026-10-15: advisory: GHSA-v75v-6fpf-gvw8 published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.