Listen to this Post
The security vulnerability designated as CVE-2026-104252 involves a critical reflected Cross-Site Scripting (XSS) flaw residing in the `twopczHandler` function within the `go/vt/vttablet/tabletserver/twopcz.go` file of Vitess. Specifically, the handler processes incoming HTTP form parameters, namely `Action` and dtid, and reflects them directly back into the dynamic HTML response payload using `fmt.Fprintln(w, msg)` without undergoing proper contextual HTML sanitization or escaping. Because the affected debug endpoint explicitly delivers content formatted under `text/html; charset=utf-8` and operates under a default allow-all access control list (aclpolicy), any remote unauthenticated user can craft a malicious URL containing JavaScript payloads. When a database operator or administrator visits this crafted link, the script executes within the browser under the same-origin context of the vttablet debug interface. This unauthorized script execution grants attackers the ability to silently query and exfiltrate highly sensitive internal diagnostic components, such as active transaction identifiers via /twopcz, live query execution plans via /queryz, recent query logs containing bound parameters via /querylogz, transaction logs via /txlogz, and sensitive environment variables or deployment configurations via /debug/env. Mitigation requires updating to patched versions or restricting access to administrative ports.
DailyCVE Form:
Platform: Vitess
Version: Prior to 23.0.5 and 24.0.2
Vulnerability : Reflected XSS
Severity: Critical
date: June 2026
Prediction: Already Released
What Undercode Say: Analytics
The vulnerability arises due to the direct handling and reflection of unsanitized form parameters inside the Go HTTP serving function. The insecure code path outputs data straight into the HTTP writer configured for HTML rendering:
msg := fmt.Sprintf("%s(%s): completed.", action, dtid)
fmt.Fprintln(w, msg)
How Exploit: (Educational Purposes!)
Attackers can exploit this flaw by tricking an authenticated operator into opening a specially crafted URL targeting the vttablet HTTP debug interface.
Example payload targeting the Action parameter:
curl -sS -i "http://<vttablet-ip>:15999/twopcz?Action=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&dtid=test"
Example payload targeting the dtid attribute context:
curl -sS -i "http://<vttablet-ip>:15999/twopcz?Action=Demo&dtid=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E"
Protection: from this CVE
Administrators should immediately upgrade Vitess to version 23.0.5, 24.0.2, or later where the official patch is applied. The fix introduces proper string sanitization using the standard library:
import "html"
// ...
msg := fmt.Sprintf("%s(%s): completed.", action, dtid)
fmt.Fprintln(w, html.EscapeString(msg))
If upgrading immediately is not feasible, apply network mitigations by firewalling the vttablet HTTP port (default 15999) away from public exposure, restricting access exclusively to trusted internal networks, or configuring a strict custom access control list (aclpolicy) instead of relying on the default allow-all configuration.
Impact
Successful exploitation of this flaw allows malicious scripts to execute inside an administrator’s browser session with same-origin access privileges. This enables attackers to harvest critical database diagnostic data, intercept live query parameters, read database transaction histories, and extract sensitive environment variables or credentials exposed via unauthenticated debug paths.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
