CVE-2026-104252: Vitess vttablet /twopcz reflected XSS
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vitessto a version that resolves this vulnerability.Fixed in 23.0.5 - Upgrade
Upgrade
Vitessto a version that resolves this vulnerability.Fixed in 24.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
vttablet and vtcombo instances that expose the /twopcz HTTP debug endpoint are affected when using the default allow-all ACL policy. The issue affects versions before 23.0.5 and 24.0.2.
What must an attacker do to exploit this issue?
An unauthenticated remote attacker must cause an operator to open a crafted request to the /twopcz endpoint. The injected script then executes in the operator's browser under the vttablet debug origin.
What could an attacker access through successful exploitation?
The script can read same-origin diagnostic endpoints available in that deployment. These may expose query, transaction, environment, variable, or profiling data.
What can be done if an immediate upgrade is not possible?
Restrict access to the vttablet and vtcombo /twopcz debug endpoint rather than relying on the default allow-all ACL policy. This reduces the ability of unauthenticated remote attackers to deliver the crafted request.
How can I remediate the vulnerability?
Upgrade Vitess to version 23.0.5 or 24.0.2, which contain the fix.