External risk intelligence

Vitess twopcz Handler Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-104252

The vulnerability exists in an HTTP debug endpoint of a database clustering component (vttablet/vtcombo). While network-accessible, these management and diagnostic endpoints are typically intended for internal administrative use and are generally not exposed to the public internet in standard deployment patterns.

Cross-site Scripting

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability exists in Vitess, a database clustering system, which could allow unauthenticated attackers to execute scripts in a user's browser. This could potentially expose sensitive diagnostic data like queries and transaction information. The issue is addressed in updated versions of the software.

Unescaped web input allows script execution.
Exposes diagnostic data, impacting data privacy.
Confirm if Vitess is deployed and ensure it is updated.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a debug endpoint on the Vitess vttablet or vtcombo server. If an operator accesses this request, malicious script could execute in their browser, potentially leading to the exposure of sensitive diagnostic data.

Network access required.
Triggered via crafted HTTP debug request.
Risk of sensitive data exposure.

Live Threat

Current exploitation, exposure, and threat context

The Vitess database clustering system, when running older versions, has a flaw in its HTTP debug endpoint. An attacker could send a specially crafted request to this endpoint, which, when opened by an operator, could execute malicious scripts in their browser. This script could then access diagnostic information about the Vitess deployment, such as query, transaction, environment, or profiling data.

Diagnostic and operational data.
Via crafted HTTP debug requests.
Exposure of sensitive system information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application and platform teams are likely responsible for addressing this vulnerability in Vitess, as it affects a database clustering system. The initial practical step is to identify all instances of Vitess, confirm their network reachability and business criticality, and then pinpoint the accountable owner for remediation planning based on assessed risk.

Platform and application teams should own.
Verify Vitess instance reachability and criticality.
Plan remediation and coordinate vendor updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Vitess and where is it used?

Vitess is an open-source database clustering system designed for horizontal scaling of MySQL workloads. It acts as a middleware layer that manages large deployments, enabling databases to handle significantly higher traffic by partitioning and distributing data across multiple nodes. You will typically find Vitess deployed in cloud-native environments or large-scale architectures where high availability and massive database throughput are required.

How does CVE-2026-104252 work?

This vulnerability is a Cross-Site Scripting (XSS) flaw, classified as CWE-79. It occurs because the twopczHandler component in Vitess fails to properly sanitize specific input before displaying it in an HTML response. When an operator interacts with a maliciously crafted HTTP request, the browser mistakenly interprets the input as executable code. This allows the script to run with the privileges of the Vitess debug interface, potentially accessing sensitive diagnostic information.

What triggers this vulnerability in Vitess?

An attacker triggers this by sending a specially crafted request to the specific /twopcz HTTP debug endpoint on a vttablet or vtcombo server. The vulnerability requires an operator to open or view this malicious input in their browser. Crucially, if the debug endpoint is not reachable or if no operator ever accesses the processed output, the script will not execute, meaning internal requests that are never viewed by an administrative user do not trigger the bug.

Is my Vitess deployment at risk?

Halo Surface Signal indicates that while this is a network-level issue, it is unlikely to be exposed to the public internet in standard configurations. These debug endpoints are intended for internal administrative tasks rather than public traffic. You should prioritize assessing instances that are unintentionally exposed or accessible to untrusted users, as these provide the necessary network path for an attacker to reach the vulnerable handler.

How do I secure my Vitess environment?

The primary response is to update your Vitess software to version 23.0.5 or 24.0.2, where this handler has been corrected. Beyond updating, teams should audit their network policies to ensure that management and diagnostic endpoints are restricted to authorized internal networks. Confirming which instances are running older versions is the necessary first step for your platform or application teams to begin the patching process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.