Vitess Debug Pages Critical XSS CVE-2026-104252 Patches in 23.0.5 and 24.0.2

Vitess, a database clustering system designed for horizontal scaling of MySQL, contains a critical cross-site scripting flaw in its debug endpoints. According to the National Vulnerability Database record for CVE-2026-104252, the issue stems from improper handling of user input in the twopczHandler. This component processes requests for the /twopcz HTTP debug endpoint found in both vttablet and vtcombo services. The vulnerability allows remote, unauthenticated attackers to inject malicious scripts that execute in the browser of any operator who views the affected page.

Root cause

The technical root of CVE-2026-104252 is the lack of HTML escaping for specific form values. The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go takes the Action and dtid parameters from incoming requests. It then writes these values directly into a text/html response without sanitizing them. This behavior violates standard secure coding practices for web applications. Because the output is rendered as HTML, any script tags included in the Action or dtid fields are executed by the browser. The vulnerability is categorized under CWE-79, which covers improper neutralization of input during web page generation.

Attack path

An attacker does not need authentication to exploit this flaw. Under the default allow-all access control list policy, any remote user can send a crafted HTTP request to the vulnerable endpoint. The request includes malicious JavaScript within the Action or dtid form values. When a database operator opens this request in their browser, the script executes immediately. The script runs with the origin of the vttablet debug interface. This context allows the injected code to read same-origin diagnostic endpoints. Attackers can thus access query details, transaction logs, environment variables, and profiling data exposed by that specific deployment.

Affected versions

The vulnerability affects specific release lines of the Vitess database clustering system. According to the advisory, any version prior to 23.0.5 is vulnerable. Additionally, versions starting from 24.0.0 up to, but not including, 24.0.2 are also affected. Organizations running these specific versions expose their debug endpoints to potential exploitation. The issue was resolved in the release of version 23.0.5 for the 23.x branch. Similarly, version 24.0.2 addresses the flaw for the 24.x branch. Users of intermediate versions remain at risk until they upgrade.

Mitigation

• Upgrade Vitess to version 23.0.5 or later if using the 23.x release line.
• Upgrade Vitess to version 24.0.2 or later if using the 24.x release line.
• Restrict access to the /twopcz debug endpoint using network-level access controls.
• Disable debug endpoints entirely in production environments where they are not required for active troubleshooting.

Signals worth monitoring

Security teams should monitor for unusual traffic directed at debug endpoints like /twopcz. Look for HTTP requests containing encoded script tags or long, complex strings in form parameters such as Action or dtid. Check server logs for responses that return large HTML payloads to unauthenticated sources. Monitor for outbound connections from debug interfaces to external domains, which may indicate data exfiltration. Review browser console logs in operator workstations for unexpected script execution errors. Investigate any access to sensitive diagnostic endpoints immediately following a request to a debug handler.

What to do and how to stay safe: Vitess

• Audit your Vitess deployment to identify if debug endpoints are accessible from untrusted networks.
• Verify your current Vitess version against the list of affected releases provided by the vendor.
• Apply the latest security patches to move to version 23.0.5 or 24.0.2 once available.
• Implement strict access controls to limit debug endpoint access to authorized administrative IPs only.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-104252?

The National Vulnerability Database rates CVE-2026-104252 as a 9.8, which is considered critical severity.

Which Vitess components are affected by this vulnerability?

The flaw affects the twopczHandler within the vttablet and vtcombo components of the Vitess system.

Is authentication required to exploit this cross-site scripting flaw?

No, the vulnerability allows a remote unauthenticated attacker to exploit the endpoint under default settings.