ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-104252

Vitess is a database clustering system for horizontal scaling of MySQL.

Published Oct 13, 2026 · catalog updated Oct 15, 2026 · Vitess is a database

Check if you run it

No confirmed exploitation is on record for CVE-2026-104252. EPSS is 0.89%. Act only if a listed version of Vitess is a database is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Vitess is a database).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.89%
Remediation
Version ranges on file
Affected products
go vitess.io/vitess · golang vitess.io

From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800 ## Summary The in (line 185) reflects the and form values directly into the HTML response body via — **without HTML escaping**. The response is served as , and Vitess's default policy is **allow-all**, so the endpoint is reachable by anyone who can hit the vttablet's HTTP port (default , multiplexed with gRPC and MySQL wire-protocol ports). A crafted or value yields a **reflected XSS** that executes in the operator's browser with same-origin access to the vttablet's debug endpoints. This includes (live query plans), (recent queries with bound values), (transactions), (environment variables — may include MySQL/topology credentials), (expvar stats), and if enabled. The bug was introduced before v20.0.0 (long-standing) and was silently fixed in commit (merged 2026-06-09, PR #20255, "tabletserver: escape reflected form values in twopcz handler"). The fix replaces with . **No released version of Vitess contains the fix** — the fix lives only on (current tip , 2026-06-23). There is **no CVE, GHSA, or OSV entry** for this specific bug (verified 2026-06-24 against GitHub Advisory Database, OSV.dev, and NVD). ## Impact | Field | Value | |-------|-------| | **Type** | Reflected Cross-Site Scripting (XSS) | | **CVSS 3.1** | = **7.7 HIGH** | | **Attack Vector** | Network (vttablet HTTP port 15999, multiplexed with gRPC/MySQL) | | **Attack Complexity** | Low (craft URL, send to operator) | | **Privileges Required** | None (default policy is allow-all) | | **User Interaction** | Required (operator must visit crafted URL) | | **Scope** | Changed (XSS chain reaction to other vttablet debug endpoints) | | **Confidentiality** | High (query text, env vars, expvar stats) | | **Integrity** | None (XSS itself doesn't change state) | | **Availability** | None (XSS itself doesn't disrupt service) | ### Affected versions (verified) All released version

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • go vitess.io/vitess< 0.23.5
  • go vitess.io/vitess>= 0.24.0, < 0.24.2
  • golang vitess.ioversion unspecified

How to fix CVE-2026-104252

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-104252. EPSS is 0.89%. Act only if a listed version of Vitess is a database is installed.

Which versions are affected?

Compare what you have installed with < 0.23.5, >= 0.24.0, < 0.24.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-116; CWE-79: Cross-site Scripting (XSS); CWE-80: Basic XSS. EPSS 0.89%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · NIST NVD

    Detected

    Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a cr

  2. Oct 15, 2026 · NIST NVD

    Updated

    Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a cr

  3. Oct 15, 2026 · GitHub Advisory Database

    Updated

    From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800 ## Summary The in (line 185) reflects the and form values directly into the HTML response body via — **without HTML escaping**. The response is served as , and Vitess's default policy is **allow-all**, so the endpoint is reachable by anyone who can hit the vt

Sources

  • CVE.orgVulnerability recordCVE-2026-104252

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-104252

    30-day exploitation probability 0.9%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-v75v-6fpf-gvw8

    Vitess vttablet /twopcz reflected XSS

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-104252

    The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go (line 185) reflects the Action and dtid form values directly into the HTML response body via fmt.Fprintln(w, msg) — without HTML escaping. The response is served as text/html; charset=utf-8, and Vitess's default acl policy is allow-all, so the endpoint is reachable by anyone who can hit the vttablet's HTTP port (default 15999, multiplexed

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-104252

    Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response wi

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.