Vttablet (< 0.23.5, >= 0.24.0, < 0.24.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/vttablet--0.23.5--0.24.0--0.24.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 22:23:17 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgReflected XSS Vulnerability in Vitess vttablet twopczHandlerhttps://feed.craftedsignal.io/briefs/2026-10-vitess-xss/Thu, 15 Oct 2026 22:23:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-vitess-xss/An unauthenticated reflected XSS vulnerability (CVE-2026-104252) in the Vitess vttablet twopczHandler allows attackers to execute arbitrary JavaScript in the context of an operator's session, potentially exposing sensitive debug information.The Vitess vttablet component is vulnerable to reflected Cross-Site Scripting (XSS) due to improper input sanitization in the twopczHandler located in go/vt/vttablet/tabletserver/twopcz.go. The handler incorrectly reflects user-controlled Action and dtid form values directly into the HTML response body without HTML escaping. Because the endpoint serves responses as text/html and utilizes an 'allow-all' default access control policy, unauthenticated attackers can trigger this vulnerability by tricking an authenticated operator into visiting a specially crafted URL.

Successful exploitation allows for the execution of arbitrary JavaScript within the operator's browser session. Given the same-origin nature of the attack, the script can access sensitive unauthenticated debug endpoints such as /queryz, /querylogz, /debug/env, and /debug/vars, which may contain query plans, transactional data, MySQL credentials, and topology information. The vulnerability affects all released versions of Vitess prior to the inclusion of the fix (merged into the main branch on 2026-06-09).

Impact

The vulnerability is categorized as high severity (CVSS 7.7) because it allows for the exfiltration of sensitive configuration data and database credentials. While the vulnerability does not directly disrupt service, the exposure of environment variables via /debug/env could lead to full database compromise or secondary service disruptions if credentials are rotated or exploited offline.

Recommendation

  • Implement network-level restrictions to ensure the vttablet HTTP port (default 15999) is not exposed to untrusted networks or the public internet.
  • Override the default Vitess 'allow-all' ACL policy to require authentication for debug endpoints and the /twopcz handler.
  • Deploy a web application firewall (WAF) or reverse proxy in front of vttablet instances to sanitize incoming requests and block URLs containing suspicious patterns associated with XSS payloads (e.g., <script>, onerror, onload).
  • Prioritize upgrading Vitess once patch releases addressing CVE-2026-104252 are available for your respective version branch.
]]>highadvisoryxssweb-vulnerabilityvitesscve-2026-104252