{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vttablet--0.23.5--0.24.0--0.24.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vitess:vitess:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-104252"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["vttablet (\u003c 0.23.5, \u003e= 0.24.0, \u003c 0.24.2)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","vitess","cve-2026-104252"],"_cs_type":"advisory","_cs_vendors":["Vitess"],"content_html":"\u003cp\u003eThe Vitess \u003ccode\u003evttablet\u003c/code\u003e component is vulnerable to reflected Cross-Site Scripting (XSS) due to improper input sanitization in the \u003ccode\u003etwopczHandler\u003c/code\u003e located in \u003ccode\u003ego/vt/vttablet/tabletserver/twopcz.go\u003c/code\u003e. The handler incorrectly reflects user-controlled \u003ccode\u003eAction\u003c/code\u003e and \u003ccode\u003edtid\u003c/code\u003e form values directly into the HTML response body without HTML escaping. Because the endpoint serves responses as \u003ccode\u003etext/html\u003c/code\u003e and utilizes an 'allow-all' default access control policy, unauthenticated attackers can trigger this vulnerability by tricking an authenticated operator into visiting a specially crafted URL.\u003c/p\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript within the operator's browser session. Given the same-origin nature of the attack, the script can access sensitive unauthenticated debug endpoints such as \u003ccode\u003e/queryz\u003c/code\u003e, \u003ccode\u003e/querylogz\u003c/code\u003e, \u003ccode\u003e/debug/env\u003c/code\u003e, and \u003ccode\u003e/debug/vars\u003c/code\u003e, which may contain query plans, transactional data, MySQL credentials, and topology information. The vulnerability affects all released versions of Vitess prior to the inclusion of the fix (merged into the \u003ccode\u003emain\u003c/code\u003e branch on 2026-06-09).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability is categorized as high severity (CVSS 7.7) because it allows for the exfiltration of sensitive configuration data and database credentials. While the vulnerability does not directly disrupt service, the exposure of environment variables via \u003ccode\u003e/debug/env\u003c/code\u003e could lead to full database compromise or secondary service disruptions if credentials are rotated or exploited offline.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement network-level restrictions to ensure the vttablet HTTP port (default 15999) is not exposed to untrusted networks or the public internet.\u003c/li\u003e\n\u003cli\u003eOverride the default Vitess 'allow-all' ACL policy to require authentication for debug endpoints and the \u003ccode\u003e/twopcz\u003c/code\u003e handler.\u003c/li\u003e\n\u003cli\u003eDeploy a web application firewall (WAF) or reverse proxy in front of vttablet instances to sanitize incoming requests and block URLs containing suspicious patterns associated with XSS payloads (e.g., \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e, \u003ccode\u003eonerror\u003c/code\u003e, \u003ccode\u003eonload\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003ePrioritize upgrading Vitess once patch releases addressing CVE-2026-104252 are available for your respective version branch.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:23:17Z","date_published":"2026-10-15T22:23:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vitess-xss/","summary":"An unauthenticated reflected XSS vulnerability (CVE-2026-104252) in the Vitess vttablet twopczHandler allows attackers to execute arbitrary JavaScript in the context of an operator's session, potentially exposing sensitive debug information.","title":"Reflected XSS Vulnerability in Vitess vttablet twopczHandler","url":"https://feed.craftedsignal.io/briefs/2026-10-vitess-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Vttablet (\u003c 0.23.5, \u003e= 0.24.0, \u003c 0.24.2)","version":"https://jsonfeed.org/version/1.1"}