EUVD-2026-100525
GHSA-v75v-6fpf-gvw8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed /twopcz debug endpoint with allow-all ACL
-
DeliveryCraft request with script in Action/dtid value
-
ExploitDeliver link to operator
-
ExecutionOperator opens request, script executes in browser
-
PersistScript reads same-origin diagnostic/query/profiling data
-
ImpactExfiltrate sensitive deployment data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the vttablet or vtcombo /twopcz HTTP debug endpoint to be reachable by the attacker under the default allow-all ACL policy; if the ACL is restricted or the debug endpoint is not network-exposed, exploitation is prevented. Exploitation additionally requires operator interaction: a targeted operator must open the attacker-crafted request in a browser for the reflected script to execute. Impact is bounded to data readable from same-origin diagnostic endpoints in that specific deployment, so the realistic consequence depends on what diagnostic data the deployment exposes. |
| Impact | The input CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) significantly overstates real-world risk and conflicts with the description. This is a reflected XSS (CWE-79) in the vttablet/vtcombo /twopcz HTTP debug endpoint, confirmed by the vendor patch (commit 3140c1846 adds html.EscapeString to the reflected Action/dtid values). Two signals conflict: the vector claims UI:N, but the description explicitly requires an operator to open an attacker-crafted request, so user interaction is in fact required (UI:R) - verify with vendor, as the scored vector appears mislabeled. The I:H/A:H impacts are also inflated: the described consequence is primarily same-origin reading of diagnostic data (query, transaction, environment, variable, profiling), i.e. a confidentiality impact, not full integrity/availability loss. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is 'no public exploit identified at time of analysis.' Net: this is a genuine but conditional XSS requiring a non-default-friendly exposure (default allow-all ACL) plus operator interaction - a medium-to-high-priority patch for exposed deployments, not the near-wormable 9.8 the raw score implies. |
| Exploit ScenarioDerived | An attacker who can reach a vttablet/vtcombo instance running the default allow-all ACL sends an operator a link to /twopcz with a crafted Action or dtid form value containing script. When the operator opens it, the script executes in their browser under the vttablet debug origin and reads same-origin diagnostic endpoints exposing query, transaction, environment, and profiling data. No public exploit is identified at time of analysis, though the vendor test case demonstrates the injection with a <script>alert(1)</script> payload. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Reflected cross-site scripting in the Vitess vttablet and vtcombo /twopcz HTTP debug endpoint allows a remote, unauthenticated attacker (per the supplied CVSS vector, PR:N) to inject script into the response by supplying crafted Action and dtid form values, which twopczHandler writes into a text/html response without HTML escaping. Successful exploitation requires operator interaction - a targeted operator must open the attacker-crafted request in a browser - after which the script runs with the vttablet debug origin and can read same-origin diagnostic endpoints exposing query, transaction, environment, variable, or profiling data present in that deployment. Affected deployments are those running Vitess before 23.0.5 or 24.0.x before 24.0.2 where the debug endpoint is reachable under the default allow-all ACL; no public exploit code was identified at time of analysis and there is no CISA KEV entry, and the supplied 9.8 score overstates impact because the assessed vector requires user interaction and bounds integrity impact to the reflected page content.
RemediationAI
Vendor-released patch: upgrade to Vitess 23.0.5 or 24.0.2 (or later in those lines), which apply html.EscapeString to the twopczHandler output as shown in the linked commits and tracked in GHSA-v75v-6fpf-gvw8; the release tags are https://github.com/vitessio/vitess/releases/tag/v23.0.5 and https://github.com/vitessio/vitess/releases/tag/v24.0.2. Because the exploit path depends entirely on reachability of the debug endpoint under the default allow-all ACL, the highest-value compensating control for environments that cannot patch immediately is to tighten the vttablet/vtcombo ACL policy so /twopcz is restricted to trusted administrative hosts, and to firewall the debug HTTP port so it is not exposed to untrusted networks - the trade-off is that operators lose remote access to diagnostic endpoints unless they use an SSH tunnel or bastion, and any monitoring or tooling that scrapes these debug handlers must be re-pointed. Disabling or gating the debug endpoints where they are not required removes the attack surface entirely but sacrifices the query, transaction, environment, variable, and profiling telemetry those handlers provide. Finally, since exploitation requires an operator to open the crafted link, user-education and link-scanning controls reduce the residual risk but are not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vitess is a MySQL-compatible database clustering and sharding system; vttablet is the per-tablet agent that serves query traffic and exposes an HTTP debug surface, including /twopcz, which drives the two-phase commit (2PC) transaction coordination state visible in the _vt tables. The root cause is CWE-79 (improper neutralization of input during web page generation): twopczHandler in go/vt/vttablet/tabletserver/twopcz.go reflected the Action and dtid request form values straight into the response with fmt.Fprintln, and because the endpoint served the result as text/html, a request such as /twopcz?Action=<script>...&dtid=zz rendered attacker-controlled markup rather than the escaped literal. The upstream fix imports the Go html package and wraps the message with html.EscapeString, and the accompanying unit test TestTwopczHandlerEscapesActionMessage asserts that the payload no longer appears unescaped in the body - a textbook contextual-output-escaping remediation. The security relevance is amplified by the debug endpoint's same-origin trust: injected script executes in the vttablet debug origin and can fetch sibling diagnostic handlers that expose query, transaction, environment, variable, or profiling state, chaining a simple XSS into disclosure of operational telemetry that is normally not intended for browsers.
Know when Vitess gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reflected XSS needs the operator to open a crafted request (UI:R) and executes across origin/authority (S:C); impact is mainly reading same-origin diagnostic data (C:H), limited integrity, no availability loss.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script runs with the vttablet debug origin and can read same-origin diagnostic endpoints that expose query, transaction, environment, variable, or profiling data available in that deployment. This issue is fixed in versions 23.0.5 and 24.0.2.
Technical POC Analysis
Reflected cross-site scripting, primary weakness CWE-79.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Vitess vttablet and vtcombo deployments using the /twopcz debug endpoint face a critical-severity reflected script-injection issue that could let a targeted operator be tricked into exposing sensitive diagnostic data from the database environment. Although no public exploit identified at time of analysis and no CISA KEV entry is present, the affected components are part of critical data infrastructure, and successful attacks require operator interaction, so leadership should prioritize patching and reducing debug-endpoint exposure to protect operational and customer data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Command injection in Vitess MySQL clustering system before 23.0.3/22.0.4. Users with read/write access to the backup sto
Path traversal in Vitess backup manifest handling allows authenticated attackers with access to backup storage to write
Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Rated medium severi
Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL st
Vitess is a database clustering system for horizontal scaling of MySQL. Rated low severity (CVSS 2.7), this vulnerabilit
Exploit-DB