CVE-2026-104252

Name of the Vulnerable Software and Affected Versions Vitess versions prior to 23.0.5 Vitess versions prior to 24.0.2

Description The twopczHandler function in go/vt/vttablet/tabletserver/twopcz.go fails to perform HTML escaping when writing Action and dtid form values from the /twopcz HTTP debug endpoint into a text/html response. A remote unauthenticated attacker can exploit this by sending a crafted request to an operator, leading to script execution in the operator's browser. This script operates with the vttablet debug origin, allowing it to access same-origin diagnostic endpoints that expose profiling data, variables, environment details, transactions, or queries within the deployment.

Recommendations Update to version 23.0.5 or later. Update to version 24.0.2 or later.