Read the docs
TI-2026-73584 Aliases CVE-2026-104252GHSA-v75v-6fpf-gvw8

Reflected cross-site scripting in Vitess vttablet /twopcz endpoint

Priority MEDIUM 51CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Vitess versions before 23.0.5 and from 24.0.0 before 24.0.2 are affected. The twopczHandler function writes the Action and dtid form values into an HTML response without escaping, which causes reflected cross-site scripting (CWE-79). A remote unauthenticated attacker can send an operator a crafted request that runs script in the operator's browser when it is opened, under the default allow-all ACL policy. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01174 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vitess (vitessio): 23.0.5, 24.0.2vitess.io/vitess (Go): 0.23.5, 0.24.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstagevitessbefore 23.0.5; 24.0.0 to before 24.0.223.0.5, 24.0.2Patch availableCNA
—vitess.io/vitess (Go)before 0.23.50.23.5Patch availableGHSA-v75v-6fpf-gvw8
—vitess.io/vitess (Go)0.24.0 to before 0.24.20.24.2Patch availableGHSA-v75v-6fpf-gvw8
  • vitess Vendorbackstage Affected before 23.0.5; 24.0.0 to before 24.0.2 Fixed in 23.0.5, 24.0.2 Patch available CNA
  • vitess.io/vitess (Go) Vendor— Affected before 0.23.5 Fixed in 0.23.5 Patch available GHSA-v75v-6fpf-gvw8
  • vitess.io/vitess (Go) Vendor— Affected 0.24.0 to before 0.24.2 Fixed in 0.24.2 Patch available GHSA-v75v-6fpf-gvw8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:*before 23.0.5; 24.0.0 to before 24.0.2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:vitess:*:*:*:*:*:*:*:* Versions before 23.0.5; 24.0.0 to before 24.0.2 Vulnerable ·backstage

Remediation

Upgrade Vitess to 23.0.5 or 24.0.2, or upgrade the Go module vitess.io/vitess to 0.23.5 or 0.24.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA vitess (vitessio) Fixed in 23.0.5, 24.0.2
  • Fix · GHSA-v75v-6fpf-gvw8 vitess.io/vitess (Go) Fixed in 0.23.5 Advisory →
  • Fix · GHSA-v75v-6fpf-gvw8 vitess.io/vitess (Go) Fixed in 0.24.2 Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-104252
  2. 2026-10-16 Alias added: GHSA-v75v-6fpf-gvw8
  3. 2026-10-16 Fix available: Go/vitess.io/[email protected], Go/vitess.io/[email protected] · GHSA-v75v-6fpf-gvw8
  4. 2026-10-16 CVSS score added · GHSA-v75v-6fpf-gvw8
  5. 2026-10-16 Weakness changed · GHSA-v75v-6fpf-gvw8
  6. 2026-10-16 11 new references · GHSA-v75v-6fpf-gvw8
  7. 2026-10-16 CISA SSVC decision points changed

References

Exploit 1

Patch 6

Advisory 1

Other 3

  • TI-2026-22308 Vitess users with backup storage access can gain unauthorized access to production deployment environments CVSS 4.0HIGH 8.4
  • TI-2026-46986 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data CVSS 3.1MEDIUM 5.3
  • TI-2026-22312 Vitess users with backup storage access can write to arbitrary file paths on restore CVSS 4.0CRITICAL 9.3
  • TI-2023-13623 Vitess VTAdmin users that can create shards can deny access to other functions CVSS 3.1MEDIUM 4.3
  • TI-2023-13622 vitess allows users to create keyspaces that can deny access to already existing keyspaces CVSS 3.1MEDIUM 4.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences