ZeroDay Findings
Sign inSign up

Findings

CVE-2026-104252

Vitess is a database clustering system for horizontal scaling of MySQL.

Published Oct 13, 2026 · updated Oct 15, 2026

From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800 ## Summary The in (line 185) reflects the and form values directly into the HTML response body via — **without HTML escaping**. The response is served as , and Vitess's default policy is **allow-all**, so the endpoint is reachable by anyone who can hit the vttablet's HTTP port (default , multiplexed with gRPC and MySQL wire-protocol ports). A crafted or value yields a **reflected XSS** that executes in the operator's browser with same-origin access to the vttablet's debug endpoints. This includes (live query plans), (recent queries with bound values), (transactions), (environment variables — may include MySQL/topology credentials), (expvar stats), and if enabled. The bug was introduced before v20.0.0 (long-standing) and was silently fixed in commit (merged 2026-06-09, PR #20255, "tabletserver: escape reflected form values in twopcz handler"). The fix replaces with . **No released version of Vitess contains the fix** — the fix lives only on (current tip , 2026-06-23). There is **no CVE, GHSA, or OSV entry** for this specific bug (verified 2026-06-24 against GitHub Advisory Database, OSV.dev, and NVD). ## Impact | Field | Value | |-------|-------| | **Type** | Reflected Cross-Site Scripting (XSS) | | **CVSS 3.1** | = **7.7 HIGH** | | **Attack Vector** | Network (vttablet HTTP port 15999, multiplexed with gRPC/MySQL) | | **Attack Complexity** | Low (craft URL, send to operator) | | **Privileges Required** | None (default policy is allow-all) | | **User Interaction** | Required (operator must visit crafted URL) | | **Scope** | Changed (XSS chain reaction to other vttablet debug endpoints) | | **Confidentiality** | High (query text, env vars, expvar stats) | | **Integrity** | None (XSS itself doesn't change state) | | **Availability** | None (XSS itself doesn't disrupt service) | ### Affected versions (verified) All released version

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · NIST NVD

    Detected

    Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a cr

  2. Oct 15, 2026 · NIST NVD

    Updated

    Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a cr

  3. Oct 15, 2026 · GitHub Advisory Database

    Updated

    From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800 ## Summary The in (line 185) reflects the and form values directly into the HTML response body via — **without HTML escaping**. The response is served as , and Vitess's default policy is **allow-all**, so the endpoint is reachable by anyone who can hit the vt

Affected

  • go vitess.io/vitess< 0.23.5
  • go vitess.io/vitess>= 0.24.0, < 0.24.2

Sources

  • CVE.orgVulnerability recordCVE-2026-104252

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-v75v-6fpf-gvw8

    Vitess vttablet /twopcz reflected XSS

    github.com
  • NIST NVDVulnerability recordCVE-2026-104252

    Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response wi

    nvd.nist.gov

References