CVE-2026-104252
9.8 CRITICALpublic exploit availablePublished 2026-10-13 · Updated 2026-10-16
AI risk analysis
- Summary
- Vitess database system contains a cross-site scripting vulnerability in its debug endpoint that allows unauthenticated attackers to inject malicious scripts into HTML responses. When an operator opens a crafted request, the script executes in their browser with the vttablet's security context, potentially exposing sensitive diagnostic data.
- Exploitability
- Easy to exploit with no prerequisites - attackers need only send a crafted HTTP request to a vulnerable vttablet or vtcombo instance, and can rely on operator interaction to trigger execution.
- Blast radius
- High impact in environments where operators frequently interact with debug endpoints, potentially exposing sensitive query data, transaction details, and profiling information to attackers.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Vitess version 23.0.5 or 24.0.2 immediately to patch the XSS vulnerability in the /twopcz debug endpoint.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Public exploit & PoC references
- https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2
- https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af
- https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7
- https://github.com/vitessio/vitess/pull/20255
- https://github.com/vitessio/vitess/pull/20273
- https://github.com/vitessio/vitess/pull/20274
- https://github.com/vitessio/vitess/releases/tag/v23.0.5
- https://github.com/vitessio/vitess/releases/tag/v24.0.2
- https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8
All references
- https://github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2
- https://github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af
- https://github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7
- https://github.com/vitessio/vitess/pull/20255
- https://github.com/vitessio/vitess/pull/20273
- https://github.com/vitessio/vitess/pull/20274
- https://github.com/vitessio/vitess/releases/tag/v23.0.5
- https://github.com/vitessio/vitess/releases/tag/v24.0.2
- https://github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2025-61682PoC
- MEDIUMCVE-2025-71419PoC
- CRITICALCVE-2026-100133
- HIGHCVE-2026-100645PoC
- HIGHCVE-2026-100720PoC
- HIGHCVE-2026-101156
- HIGHCVE-2026-101157
- HIGHCVE-2026-101158
Related by shared AI tags and CWE weakness class. Browse the full archive.