CVE-2026-104252 · GHSA-v75v-6fpf-gvw8

Vitess vttablet /twopcz reflected XSS

Risk score: 86/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.9%
Published: 13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default …
Affected: vitess.io/vitess (go) < 0.23.5; vitess.io/vitess (go) >= 0.24.0, < 0.24.2
Fix: Upgrade vitess.io/vitess to 0.23.5 or 0.24.2 (whichever matches your release line) or later.
Exploitation: Public proof of concept

Why it is Red

CVSS 9.8 critical
Public exploit or proof of concept referenced
Remotely exploitable without logging in
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
vitess.io/vitess	go	< 0.23.5	0.23.5
vitess.io/vitess	go	>= 0.24.0, < 0.24.2	0.24.2

References

Original description

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

Last activity 13 Oct 2026. Patch Forecast updates every hour.