CVE-2026-104252 vitessio CVE debrief

Who should care

Vitess operators and administrators should assess exposure and prioritize remediation to prevent unauthorized access to diagnostic data. This includes reviewing and applying patches, restricting access to the /twopcz endpoint, and monitoring for suspicious requests. Affected operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details and take necessary actions to prevent exploitation.

Why it matters

A reflected XSS vulnerability in Vitess vttablet /twopcz endpoint requires attention from operators and administrators to prevent unauthorized access and potential data theft.

• Potential unauthorized access to diagnostic endpoints
• Possible theft of sensitive data
• Potential disruption of service
• Need for verification of affected versions and remediation

Technical summary

The twopczHandler in Vitess writes Action and dtid form values into a text/html response without HTML escaping, allowing for reflected XSS attacks. This vulnerability can be exploited by an unauthenticated attacker to execute script in the operator's browser, potentially accessing diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. The issue is fixed in versions 23.0.5 and 24.0.2, and operators should assess exposure and prioritize remediation due to potential for unauthorized access to diagnostic data.

Defensive priority

Operators should assess exposure and prioritize remediation due to potential for unauthorized access to diagnostic data.

Recommended defensive actions

• Review and apply patches for Vitess versions 23.0.5 and 24.0.2
• Restrict access to the /twopcz endpoint
• Monitor for suspicious requests to the /twopcz endpoint
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed versions. However, limited information is available on potential exploitation or victim impact. The vulnerability is confirmed to exist in Vitess versions prior to 23.0.5 and 24.0.2. Defenders should verify affected scope, review official advisories, and plan for vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.