Vttablet (< 0.23.5, >= 0.24.0, < 0.24.2)

An unauthenticated reflected XSS vulnerability (CVE-2026-104252) in the Vitess vttablet twopczHandler allows attackers to execute arbitrary JavaScript in the context of an operator's session, potentially exposing sensitive debug information.