{"id":"AZL-108039","summary":"CVE-2026-104252 affecting package vitess 19.0.4-14","details":"Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.","modified":"2026-10-15T05:37:09Z","published":"2026-10-13T20:17:12Z","upstream":["CVE-2026-104252"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104252"}],"affected":[{"package":{"name":"vitess","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/vitess"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"19.0.4-14"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108039.json"}}],"schema_version":"1.9.0"}