CVE-2026-104252

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

From: xylove21 To: [email protected] Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800

Summary

The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go (line 185) reflects the Action and dtid form values directly into the HTML response body via fmt.Fprintln(w, msg) — without HTML escaping. The response is served as text/html; charset=utf-8, and Vitess's default acl policy is allow-all, so the endpoint is reachable by anyone who can hit the vttablet's HTTP port (default 15999, multiplexed with gRPC and MySQL wire-protocol ports).

A crafted Action or dtid value yields a reflected XSS that executes in the operator's browser with same-origin access to the vttablet's debug endpoints. This includes /queryz (live query plans), /querylogz (recent queries with bound values), /txlogz (transactions), /debug/env (environment variables — may include MySQL/topology credentials), /debug/vars (expvar stats), and /debug/pprof/* if enabled.

The bug was introduced before v20.0.0 (long-standing) and was silently fixed in commit 3140c1846c (merged 2026-06-09, PR #20255, "tabletserver: escape reflected form values in twopcz handler"). The fix replaces fmt.Fprintln(w, msg) with fmt.Fprintln(w, html.EscapeString(msg)). No released version of Vitess contains the fix — the fix lives only on main (current tip 33a3c0fafe69, 2026-06-23). There is no CVE, GHSA, or OSV entry for this specific bug (verified 2026-06-24 against GitHub Advisory Database, OSV.dev, and NVD).

Impact

| Field | Value | |-------|-------| | Type | Reflected Cross-Site Scripting (XSS) | | CVSS 3.1 | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N = 7.7 HIGH | | Attack Vector | Network (vttablet HTTP port 15999, multiplexed with gRPC/MySQL) | | Attack Complexity | Low (craft URL, send to operator) | | Privileges Required | None (default acl policy is allow-all) | | User Interaction | Required (operator must visit crafted URL) | | Scope | Changed (XSS chain reaction to other vttablet debug endpoints) | | Confidentiality | High (query text, env vars, expvar stats) | | Integrity | None (XSS itself doesn't change state) | | Availability | None (XSS itself doesn't disrupt service) |

Affected versions (verified)

All released versions are vulnerable. The fix lives only on main:

| Tag | Released | twopcz.go line 185 | Status | |---|---|---|---| | v20.0.0 | 2024-06-27 | fmt.Fprintln(w, msg) | BUGGY | | v20.0.1 - v20.0.6 | 2024 | fmt.Fprintln(w, msg) | BUGGY | | v22.0.4 | 2026-02-27 | fmt.Fprintln(w, msg) | BUGGY | | v23.0.3, v23.0.4 | 2026-02 / 2026-05 | fmt.Fprintln(w, msg) | BUGGY | | v24.0.0, v24.0.1 | 2026-04 / 2026-05 | fmt.Fprintln(w, msg) | BUGGY | | main (33a3c0fafe69) | 2026-06-23 | fmt.Fprintln(w, html.EscapeString(msg)) | FIXED |

Sensitive data exposed via the same-origin XSS chain

A successful XSS lands in the vttablet's origin. From there, the attacker can fetch (via fetch() from injected JavaScript) the following same-origin endpoints, all of which are unauthenticated by default:

• /twopcz — in-flight 2PC transactions (query text, parameters, dtid)
• /queryz — live query plans
• /querylogz — recent queries with bound values
• /txlogz — transactions
• /debug/env — environment variables (may include MySQL creds, topology credentials, encryption keys)
• /debug/vars — expvar stats
• /debug/pprof/* — CPU/memory profiles (if enabled)

Reproduction (independent, runnable PoC)

The PoC is a self-contained Go HTTP server that replicates the buggy twopczHandler from Vitess v20.0.0 verbatim (using the same line-185 code). It runs on 127.0.0.1:15080 and returns the same response shape as the real Vitess endpoint.

# 1) Build the PoC (Go 1.23+)
cd /path/to/finding/CVE-pending-twopcz-xss
go build -o…

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

From: xylove21 To: [email protected] Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800

Summary

The twopczHandler in go/vt/vttablet/tabletserver/twopcz.go (line 185) reflects the Action and dtid form values directly into the HTML response body via fmt.Fprintln(w, msg) — without HTML escaping. The response is served as text/html; charset=utf-8, and Vitess's default acl policy is allow-all, so the endpoint is reachable by anyone who can hit the vttablet's HTTP port (default 15999, multiplexed with gRPC and MySQL wire-protocol ports).

A crafted Action or dtid value yields a reflected XSS that executes in the operator's browser with same-origin access to the vttablet's debug endpoints. This includes /queryz (live query plans), /querylogz (recent queries with bound values), /txlogz (transactions), /debug/env (environment variables — may include MySQL/topology credentials), /debug/vars (expvar stats), and /debug/pprof/* if enabled.

The bug was introduced before v20.0.0 (long-standing) and was silently fixed in commit 3140c1846c (merged 2026-06-09, PR #20255, "tabletserver: escape reflected form values in twopcz handler"). The fix replaces fmt.Fprintln(w, msg) with fmt.Fprintln(w, html.EscapeString(msg)). No released version of Vitess contains the fix — the fix lives only on main (current tip 33a3c0fafe69, 2026-06-23). There is no CVE, GHSA, or OSV entry for this specific bug (verified 2026-06-24 against GitHub Advisory Database, OSV.dev, and NVD).

Impact

| Field | Value | |-------|-------| | Type | Reflected Cross-Site Scripting (XSS) | | CVSS 3.1 | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N = 7.7 HIGH | | Attack Vector | Network (vttablet HTTP port 15999, multiplexed with gRPC/MySQL) | | Attack Complexity | Low (craft URL, send to operator) | | Privileges Required | None (default acl policy is allow-all) | | User Interaction | Required (operator must visit crafted URL) | | Scope | Changed (XSS chain reaction to other vttablet debug endpoints) | | Confidentiality | High (query text, env vars, expvar stats) | | Integrity | None (XSS itself doesn't change state) | | Availability | None (XSS itself doesn't disrupt service) |

Affected versions (verified)

All released versions are vulnerable. The fix lives only on main:

| Tag | Released | twopcz.go line 185 | Status | |---|---|---|---| | v20.0.0 | 2024-06-27 | fmt.Fprintln(w, msg) | BUGGY | | v20.0.1 - v20.0.6 | 2024 | fmt.Fprintln(w, msg) | BUGGY | | v22.0.4 | 2026-02-27 | fmt.Fprintln(w, msg) | BUGGY | | v23.0.3, v23.0.4 | 2026-02 / 2026-05 | fmt.Fprintln(w, msg) | BUGGY | | v24.0.0, v24.0.1 | 2026-04 / 2026-05 | fmt.Fprintln(w, msg) | BUGGY | | main (33a3c0fafe69) | 2026-06-23 | fmt.Fprintln(w, html.EscapeString(msg)) | FIXED |

Sensitive data exposed via the same-origin XSS chain

A successful XSS lands in the vttablet's origin. From there, the attacker can fetch (via fetch() from injected JavaScript) the following same-origin endpoints, all of which are unauthenticated by default:

• /twopcz — in-flight 2PC transactions (query text, parameters, dtid)
• /queryz — live query plans
• /querylogz — recent queries with bound values
• /txlogz — transactions
• /debug/env — environment variables (may include MySQL creds, topology credentials, encryption keys)
• /debug/vars — expvar stats
• /debug/pprof/* — CPU/memory profiles (if enabled)

Reproduction (independent, runnable PoC)

The PoC is a self-contained Go HTTP server that replicates the buggy twopczHandler from Vitess v20.0.0 verbatim (using the same line-185 code). It runs on 127.0.0.1:15080 and returns the same response shape as the real Vitess endpoint.

# 1) Build the PoC (Go 1.23+)
cd /path/to/finding/CVE-pending-twopcz-xss
go build -o…

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.

Vitess vttablet /twopcz reflected XSS in vitess.io/vitess