Skip to content
Threat Feed
Subscribe
high advisory

Reflected XSS Vulnerability in Vitess vttablet twopczHandler

An unauthenticated reflected XSS vulnerability (CVE-2026-104252) in the Vitess vttablet twopczHandler allows attackers to execute arbitrary JavaScript in the context of an operator's session, potentially exposing sensitive debug information.

CVE search metadata

CVE search record: CVE-2026-104252. Severity: critical. CVSS: 9.8. EPSS: 0.89%. KEV: no. Product: vttablet (< 0.23.5, >= 0.24.0, < 0.24.2). Brief: Reflected XSS Vulnerability in Vitess vttablet twopczHandler. Brief link: https://feed.craftedsignal.io/briefs/2026-10-vitess-xss/

The Vitess vttablet component is vulnerable to reflected Cross-Site Scripting (XSS) due to improper input sanitization in the twopczHandler located in go/vt/vttablet/tabletserver/twopcz.go. The handler incorrectly reflects user-controlled Action and dtid form values directly into the HTML response body without HTML escaping. Because the endpoint serves responses as text/html and utilizes an 'allow-all' default access control policy, unauthenticated attackers can trigger this vulnerability by tricking an authenticated operator into visiting a specially crafted URL.

Successful exploitation allows for the execution of arbitrary JavaScript within the operator's browser session. Given the same-origin nature of the attack, the script can access sensitive unauthenticated debug endpoints such as /queryz, /querylogz, /debug/env, and /debug/vars, which may contain query plans, transactional data, MySQL credentials, and topology information. The vulnerability affects all released versions of Vitess prior to the inclusion of the fix (merged into the main branch on 2026-06-09).

Impact

The vulnerability is categorized as high severity (CVSS 7.7) because it allows for the exfiltration of sensitive configuration data and database credentials. While the vulnerability does not directly disrupt service, the exposure of environment variables via /debug/env could lead to full database compromise or secondary service disruptions if credentials are rotated or exploited offline.

Recommendation

  • Implement network-level restrictions to ensure the vttablet HTTP port (default 15999) is not exposed to untrusted networks or the public internet.
  • Override the default Vitess 'allow-all' ACL policy to require authentication for debug endpoints and the /twopcz handler.
  • Deploy a web application firewall (WAF) or reverse proxy in front of vttablet instances to sanitize incoming requests and block URLs containing suspicious patterns associated with XSS payloads (e.g., <script>, onerror, onload).
  • Prioritize upgrading Vitess once patch releases addressing CVE-2026-104252 are available for your respective version branch.

Immediate actions

Restrict access to vttablet HTTP port 15999 to trusted management networks only.

SOC 24h

Mitigations

Firewall vttablet HTTP port 15999 from public or untrusted network exposure.

immediate IT Operations

CVE-2026-104252

Detection coverage 1

Detect CVE-2026-104252 Exploitation - XSS Attempt in vttablet twopczHandler

high

Detects exploitation attempts against CVE-2026-104252 by identifying suspicious script-related strings in the Action or dtid parameters of the /twopcz endpoint.

sigma tactics: execution, initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →