cyfenced.com →

[ CVE-2026-104252 · Published 13 Oct 2026 ]

Vitess vttablet /twopcz reflected XSS

CVSS 9.8 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.8

[ Description ]Official description

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

[ Fixes ]Fixes and patches

  • vitess.io/vitess 0.23.5Fixed version · GitHub Advisories · go package vitess.io/vitess: upgrade to 0.23.5 or later (affected < 0.23.5)
  • vitess.io/vitess 0.24.2Fixed version · GitHub Advisories · go package vitess.io/vitess: upgrade to 0.24.2 or later (affected >= 0.24.0, < 0.24.2)

[ Packages ]Affected open-source packages

[ References ]References