Most recent entries from all

fkie_cve-2026-104252

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

GHSA-v75v-6fpf-gvw8 — Vitess vttablet /twopcz reflected XSS

Affected: Go: vitess.io/vitess

From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800

## Summary

The `twopczHandler` in `go/vt/vttablet/tabletserver/twopcz.go` (line 185) reflects the `Action` and `dtid` form values directly into the HTML response body via `fmt.Fprintln(w, msg)` — **without HTML escaping**. The response is served as `text/html; charset=utf-8`, and Vitess's default `acl` policy is **allow-all**, so the endpoint is reachable by anyone who can hit the vttablet's HTTP port (default `15999`, multiplexed with gRPC and MySQL wire-protocol ports).

A crafted `Action` or `dtid` value yields a **reflected XSS** that executes in the operator's browser with same-origin access to the vttablet's debug endpoints. This includes `/queryz` (live query plans), `/querylogz` (recent queries with bound values), `/txlogz` (transactions), `/debug/env` (environment variables — may include MySQL/topology credentials), `/debug/vars` (expvar stats), and `/debug/pprof/*` if enabled.

The bug was introduced before v20.0.0 (long-standing) and was silently fixed in commit `3140c1846c` (merged 2026-06-09, PR #20255, "tabletserver: escape reflected form values in twopcz handler"). The fix replaces `fmt.Fprintln(w, msg)` with `fmt.Fprintln(w, html.EscapeString(msg))`. **No released version of Vitess contains the fix** — the fix lives only on `main` (current tip `33a3c0fafe69`, 2026-06-23). There is **no CVE, GHSA, or OSV entry** for thi…

msrc_CVE-2026-104252 — Vitess vttablet /twopcz reflected XSS

msrc_CVE-2026-104252