Vitess vttablet: Reflected cross-site scripting in /twopcz debug endpoint
Summary
Vitess, a database clustering system for horizontal scaling of MySQL, does not HTML-escape the Action and dtid form values in the /twopcz debug endpoint of vttablet and vtcombo. An attacker can send a crafted request that runs script in the operator's browser once the operator opens it. The script runs with the debug origin and can read same-origin diagnostic endpoints, which may expose queries, transactions, environment variables, or profiling data. NVD rates the issue CVSS 9.8 (critical), but the attack depends on an operator opening a crafted link.
Affected
- Vitess before 23.0.5
- Vitess 24.0.0 up to before 24.0.2
Fixed in
- Upgrade to 23.0.5
- Upgrade to 24.0.2
Workaround
Unknown. The vendor documents no workaround beyond upgrading. Restricting network access to the vttablet and vtcombo HTTP ports reduces exposure but does not fix the flaw.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- No confirmed exploitation in the wild known.
- CISA KEV status: unknown.
Our recommendation
- Identify all Vitess deployments, including vttablet, vtcombo and vtgate, and their versions.
- Upgrade to 23.0.5, 24.0.2 or a later release. Confirm the status of 22.x deployments with the vendor.
- Restrict the vttablet and vtcombo HTTP ports to management networks.
- Warn operators not to open unknown links while logged in to administration tools, and rotate any credentials that may have been exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v75v-6fpf-gvw8 github.com
- Fix commit 3140c1846cd120db34f33b2083139b4ab638aed2 github.com
- Pull request #20255 github.com
- Vitess release v23.0.5 github.com
- Vitess release v24.0.2 github.com
- GitLab advisory CVE-2026-104252 advisories.gitlab.com
- OSV GHSA-v75v-6fpf-gvw8 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:07.
Original description (NVD)
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.
NVD references (9)
- https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2
- https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af
- https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7
- https://github.com/vitessio/vitess/pull/20255
- https://github.com/vitessio/vitess/pull/20273
- https://github.com/vitessio/vitess/pull/20274
- https://github.com/vitessio/vitess/releases/tag/v23.0.5
- https://github.com/vitessio/vitess/releases/tag/v24.0.2
- https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.