CVE-2026-104252

Executive Summary

CVE-2026-104252 is a reflected cross-site scripting (XSS) vulnerability in Vitess, a database clustering system for horizontal scaling of MySQL. The flaw resides in the twopczHandler in go/vt/vttablet/tabletserver/twopcz.go, which writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can trick an operator into opening a crafted request, executing script in the operator's browser with the vttablet debug origin. Tracked as CVSS 9.8 (Critical), this is assessed as an unpatched, high-severity vulnerability with no confirmed public PoC or in-the-wild exploitation evidence.

Technical Analysis

Vitess is a database clustering system for horizontal scaling of MySQL. It is widely deployed as the sharding and connection-pooling layer in front of MySQL at scale, with the vttablet component serving as the per-shard tablet process. The vtcombo binary is a single-process variant used for testing and development that bundles the same tablet functionality. This vulnerability affects the /twopcz HTTP debug endpoint exposed by both vttablet and vtcombo.

The vulnerability mechanism is a classic reflected cross-site scripting flaw (CWE-79). The twopczHandler function in the source file go/vt/vttablet/tabletserver/twopcz.go reads the Action and dtid form values from an incoming request and writes them directly into an HTML response sent to the browser with a text/html content type. Because no HTML escaping or output encoding is applied before these values are emitted into the response body, any HTML/JavaScript content supplied by the requester is rendered and executed by the browser within the security context of the vttablet debug origin.

Critically, the NVD description notes that under the default allow-all ACL policy, the endpoint is reachable without authentication ("a remote unauthenticated attacker"). This removes the primary barrier to exploitation. The attacker does not need credentials to cause the endpoint to reflect attacker-controlled input — the attack is delivered to the endpoint and the injected content is reflected back.

The second structural weakness is the trust context. Because the script executes with the vttablet debug origin, it is same-origin with other diagnostic endpoints on the same server. From there, the injected script can issue same-origin requests to read diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This converts a reflected XSS into a data-exfiltration pivot against the database cluster's control plane. The vulnerable versions are all releases prior to 23.0.5 and 24.0.2; the fix is available in 23.0.5 and 24.0.2.

Note that the NVD description does not specify whether the endpoint requires an HTTP method constraint (e.g., POST-only), session cookies, or other transport details beyond the form values described. No public PoC or Nuclei template exists at the time of this report, so any deeper implementation-level detail would be speculative and is deliberately excluded.

Exploitation Scenarios

The attack chain is a reflected XSS delivered to an operator's browser, based strictly on the NVD description.

1. Reconnaissance / target identification. An attacker scans for exposed vttablet or vtcombo HTTP debug endpoints on the network or internet. The /twopcz endpoint, associated with the twopczHandler in go/vt/vttablet/tabletserver/twopcz.go, is the specific target. The default allow-all ACL policy means the endpoint can be reached without authentication, lowering the reconnaissance bar. The response is served as text/html, indicating a browser-renderable surface.

2. Triggering the flaw class. The attacker crafts a request whose Action and/or dtid form values contain JavaScript/HTML markup. These values are read by twopczHandler and concatenated directly into the returned HTML document without output encoding.

3. Payload/execution method (vulnerability-class level). The attacker persuades an operator to open the crafted request (e.g., a link or a request the operator initiates) in their browser. When the response is rendered, the embedded script executes as active content in the vttablet debug origin — this is the reflected XSS execution step. No public PoC is available; the attack chain is inferred from the vulnerability class and the endpoint description.

4. Post-exploitation impact. Because the script runs under the vttablet debug origin, it can make same-origin requests to other diagnostic endpoints on that deployment and read data such as query, transaction, environment, variable, or profiling information. There is no evidence of a separate mechanism to obtain server-side code execution — the impact is browser-side script execution plus credentialed same-origin reads of the debug surface, which may expose sensitive operational and schema/query data.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 9.8 — network reachable, low attack complexity, no privileges required, no user interaction per the vector while the description still requires the operator to open the request, scope unchanged, with high confidentiality, integrity, and availability impact per the metric. Organizations should treat the vector and the described user-delivery step in the narrative as complementary rather than contradictory.

Impact Assessment

The primary affected components are vttablet and vtcombo deployments of Vitess at versions prior to 23.0.5 and 24.0.2. Because Vitess sits in the data path of horizontally scaled MySQL installations, the blast radius extends to the metadata surfaced by the debug endpoints: query, transaction, environment, variable, and profiling data of the deployment.

Business impact centers on information disclosure from a control-plane component. Successful reflected XSS in the vttablet debug origin can let an attacker-driven script read same-origin diagnostic endpoints and exfiltrate operational detail about the database cluster, including queries and transaction context. Under CVSS 3.1 the vector rates Confidentiality High, Integrity High, and Availability High with Scope Unchanged and no privileges required. The high integrity and availability subscores reflect the metric's worst-case assessment; the described mechanism directly supports confidentiality exposure of operator-visible and endpoint-visible diagnostics.

Operational exposure is elevated by the default allow-all ACL policy, which allows unauthenticated reachability and makes internet-exposed or broadly reachable debug endpoints highest priority. There is no CISA KEV listing, no public PoC, and no confirmed exploit code at the time of writing, so the current risk is driven by the vulnerability's reachability and data-exposure potential rather than observed exploitation. Given the critical 9.8 score, though, defenders should prioritize hardening regardless of the absence of in-the-wild activity.

Detection Guidance

Sigma Rule

title: Vitess vttablet/vtcombo /twopcz Reflected XSS Exploitation Attempt
id: 9b1e7c42-3d5a-4f10-9c8e-104252ab0001
status: experimental
description: Detects HTTP requests to the Vitess /twopcz debug endpoint carrying HTML/script markup in the Action or dtid form values, indicating attempted reflected XSS exploitation (CVE-2026-104252).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104252
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026-104252
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith: '/twopcz'
  selection_payload:
    cs-uri-query|contains:
      - 'Action='
      - 'dtid='
  selection_xss:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<img'
      - '%3Cimg'
  condition: selection_uri and selection_payload and selection_xss
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs(User-Agent)
falsepositives:
  - Legitimate administrative testing of the /twopcz debug endpoint with markup-like test values
level: high

YARA Rule

rule CVE_2026_104252_Vitess_Twopcz_XSS_Request
{
    meta:
        description = "Detects HTTP request artifacts targeting the Vitess /twopcz debug endpoint (CVE-2026-104252 reflected XSS)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104252"
        date = "2026-01-01"
        severity = "high"

    strings:
        $path    = "/twopcz" ascii nocase wide
        $param1  = "Action=" ascii nocase
        $param2  = "dtid=" ascii nocase
        $xss1    = "<script" ascii nocase
        $xss2    = "javascript:" ascii nocase
        $xss3    = "onerror=" ascii nocase
        $xss4    = "onload=" ascii nocase
        $xss5    = "%3Cscript" ascii nocase

    condition:
        $path and ($param1 or $param2) and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104252 Vitess /twopcz Reflected XSS Attempt"; flow:established,to_server; http.uri; content:"/twopcz"; http.uri; content:"Action="; http.uri; content:"<script" or content:"%3Cscript" or content:"onerror=" or content:"javascript:"; classtype:web-application-attack; reference:cve,2026-104252; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104252; sid:10425201; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where
      http.request.method : "GET" or http.request.method : "POST" and
      url.path : "/twopcz" and
      url.query : "*Action=*" ]
  [ network where
      url.path : "/twopcz" and
      ( url.query : "*<script*" or url.query : "*%3Cscript*" or
        url.query : "*javascript:*" or url.query : "*onerror=*" or
        url.query : "*onload=*" ) ]

Splunk SPL Query

index=web (cs_uri_stem="*/twopcz*" OR uri="*/twopcz*")
(cs_uri_query="*Action=*" OR cs_uri_query="*dtid=*" OR uri_query="*Action=*" OR uri_query="*dtid=*")
(cs_uri_query="*<script*" OR cs_uri_query="*%3Cscript*" OR cs_uri_query="*javascript:*" OR cs_uri_query="*onerror=*" OR cs_uri_query="*onload=*"
 OR uri_query="*<script*" OR uri_query="*%3Cscript*" OR uri_query="*javascript:*" OR uri_query="*onerror=*" OR uri_query="*onload=*")
| stats count min(_time) as first_seen max(_time) as last_seen values(cs_uri_query) as payload by src_ip, cs_uri_stem, cs_method, cs_user_agent
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-104252,">
  <rule id="104252" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/twopcz</field>
    <regex type="pcre2">(?i)(Action|dtid)=[^&\s]*(%3Cscript|<script|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-104252: Possible Vitess /twopcz reflected XSS exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in versions 23.0.5 and 24.0.2, but no vendor advisory, OSV entry, or tracked patch source was available at the time of this report; treat the fix status as reported-by-description rather than independently verified via tracked sources.

1. Immediate mitigations:

• Remove or restrict network access to the vttablet and vtcombo /twopcz HTTP debug endpoint. It should not be reachable from untrusted networks or the public internet. Apply network segmentation and firewall rules so only authorized management hosts can reach tablet debug ports.
• Replace the default allow-all ACL policy with a deny-by-default posture so debug and diagnostic endpoints are not unauthenticated-reachable.
• If the endpoint must remain accessible for operations, front it with a reverse proxy that enforces authentication and applies strict output encoding/inspection, though this is a compensating control and not a substitute for upgrading.
• Treat the browser origin of the debug endpoint as untrusted: avoid logging into or browsing sensitive administrative interfaces from the same browser session/origin.

2. Patch/upgrade steps:

• Upgrade Vitess to 23.0.5 or 24.0.2 (or later) as stated in the NVD description. Because tracked patch sources are empty (0/4), verify the fix against the official Vitess release notes and commit history before relying solely on the version number.
• After upgrading, confirm the twopczHandler in go/vt/vttablet/tabletserver/twopcz.go applies output encoding to the Action and dtid values.
• Re-validate that the ACL policy is not left in an allow-all state post-upgrade.

3. Long-term hardening:

• Apply contextual output encoding to all reflected values in HTTP handlers and adopt a secure templating layer for debug/admin endpoints.
• Enforce a Content-Security-Policy on debug endpoints to limit script execution, and set Content-Type appropriately.
• Inventory all Vitess tablet/combo instances and continuously detect exposed debug endpoints.
• Adopt a routine patch cadence for Vitess and monitor NVD/OSV for this CVE as patch evidence matures.

References

1. NVD — CVE-2026-104252: https://nvd.nist.gov/vuln/detail/CVE-2026-104252
2. Vitess project documentation and release notes (versions 23.0.5 / 24.0.2) — https://vitess.io/
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CWE-79 — Improper Neutralization of Input During Web Page Generation (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
5. CISA Known Exploited Vulnerabilities Catalog (checked; CVE-2026-104252 is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or confirmed exploit-in-the-wild evidence for CVE-2026-104252 were identified at the time of this report. No public PoC or Nuclei template is available; the EPSS score has not yet been published by FIRST.org.