Input Validation Flaw in Vitess Database Clustering System by Vitess
CVE-2026-104252

9.8CRITICAL

Key Information:

Vendor

Vitessio

Status
Vitess
Vendor
CVE Published:
13 October 2026

What is CVE-2026-104252?

The Vitess database clustering system, which facilitates horizontal scaling for MySQL, contains a significant input validation flaw. Specifically, the twopczHandler component fails to properly escape HTML in responses generated from HTTP endpoints. This vulnerability can allow remote, unauthenticated attackers to send malicious requests that result in the execution of scripts in the browsers of operators, exposing sensitive data. The issue has been mitigated in versions 23.0.5 and 24.0.2, where proper HTML escaping measures were implemented.

Affected Version(s)

vitess < 23.0.5 < 23.0.5

vitess >= 24.0.0, < 24.0.2 < 24.0.0, 24.0.2

References

https://github.com/vitessio/vitess/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/vitessio/vitess/pull/20255
x_refsource_MISC
https://github.com/vitessio/vitess/pull/20273
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.