CVE-2026-104252

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Vitess Database Clustering System

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104252

EUVD

EUVD-2026-100525

Affected Vendors & Products

Vendor	Product	Version / Range
vitessio	vitess	< 23.0.5
vitessio	vitess	>= 24.0.0, < 24.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-104252 is a reflected Cross-Site Scripting (XSS) vulnerability in Vitess's vttablet component. It exists in the twopczHandler function where user-supplied form values (Action and dtid) are directly reflected into an HTML response without escaping. This allows an attacker to inject malicious scripts via crafted URLs that execute in the victim's browser when accessed.

Detection Guidance

Check if the vttablet HTTP port (default 15999) is accessible and if the /twopcz endpoint is enabled. Use curl to test the endpoint: curl -v http://<vttablet-ip>:15999/twopcz?Action=<script>alert(1)</script>&dtid=test. If the response reflects the script without escaping, the system is vulnerable.

Impact Analysis

An attacker can exploit this to run malicious scripts in the context of a Vitess operator's browser. This grants access to sensitive debug endpoints exposing query, transaction, environment, variable, or profiling data. The attacker could steal credentials, topology details, or other sensitive information available in the deployment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Exposure of credentials or personal data via debug endpoints may result in compliance breaches, potential fines, and reputational damage.

Mitigation Strategies

Upgrade Vitess to version 23.0.5 or 24.0.2 or later to apply the fix.
Restrict access to the vttablet HTTP port (15999) using firewalls or network policies.
Disable debug endpoints like /twopcz, /queryz, /debug/env, etc., if not required.
Set a non-default ACL policy to limit access to debug endpoints.
Use a reverse proxy to filter and sanitize requests to the vttablet HTTP port.

Hi! I’m here to help you understand CVE-2026-104252. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70