Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by GitHub_M

CVE-2026-104252Vitess vttablet /twopcz reflected XSS

Critical 9.8

In plain English

A critical-severity cross-site scripting in vitess from vitessio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.2%top 32.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Govitess.io/vitess0.23.5GHSA-v75v-6fpf-gvw8
Govitess.io/vitess0.24.2GHSA-v75v-6fpf-gvw8
Govitess.io/vitess0.23.5, 0.24.2GO-2026-6798

Affected products (as reported)

VendorProductVersions
vitessio vitess < 23.0.5>= 24.0.0, < 24.0.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References