vitessio CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL vitessio CVE published 2026-10-13

CVE-2026-104252

A reflected XSS vulnerability exists in Vitess vttablet /twopcz endpoint. An unauthenticated attacker can send a crafted request that executes script in the operator's browser, potentially accessing diagnostic endpoints. This issue requires attention from operators and administrators to prevent unauthorized access and potential data theft. The vulnerability is fixed in versions 23.0.5 and 24.0.2. Operator [truncated]

MEDIUM vitessio CVE published 2026-08-18

CVE-2026-65959

CVE-2026-65959 is a medium-severity vulnerability in Vitess, a database clustering system for horizontal scaling of MySQL. The vulnerability exists in versions 24.0.2 and earlier, where the /debug/vrlog endpoint allows a remote caller to bypass the configured security policy and stream VrLogStats data, including literal SQL statements and bound application values from certain workflows.