{"id":"CVE-2020-10996","details":"An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transition_key for SST processes in place of the random key expected.","modified":"2026-07-08T20:04:02.183431Z","published":"2020-04-27T13:15:12.333Z","references":[{"type":"ADVISORY","url":"https://www.percona.com/blog/2020/04/20/cve-2020-10996-percona-xtradb-cluster-sst-script-static-key/"},{"type":"ADVISORY","url":"https://www.percona.com/doc/percona-xtradb-cluster/LATEST/release-notes/Percona-XtraDB-Cluster-5.7.28-31.41.2.html"},{"type":"REPORT","url":"https://jira.percona.com/browse/PXC-3117"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/percona/percona-xtradb-cluster","events":[{"introduced":"0"},{"fixed":"939b65f804c4d11372aa7b19df46a0afb29eea41"}],"database_specific":{"cpe":"cpe:2.3:a:percona:xtradb_cluster:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.7.28-31.41.2"}],"source":"CPE_RANGE"}}],"versions":["Percona-XtraDB-Cluster-5.7.28-31.41","Percona-XtraDB-Cluster-5.7.19-29.22","pxc_5.6.25-25.12-3.12","Percona-XtraDB-Cluster-5.6.24-25.11","Percona-XtraDB-Cluster-5.6.20-25.7","Percona-XtraDB-Cluster-5.6.19-25.6","Percona-XtraDB-Cluster-5.6.15-25.5","Percona-XtraDB-Cluster-5.6.15-25.4","Percona-XtraDB-Cluster-5.6.15-25.3","Percona-XtraDB-Cluster-5.6.15-25.2","Percona-XtraDB-Cluster-5.6.14-25.1","pre-null-merge","Percona-Server-5.6.5-60.0","last-PS-5.5-as-patches"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10996.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}