CVE-2026-111387highCWE-212

CVE-2026-111387: high-severity vulnerability in nezhahq nezha

Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint

Published

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.3%
exploitation probability
0.3%top 83% of all CVEs
observed exploitation
nono source reports it
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
nezhahq · nezha
Related CVEs — nezhahq nezha

In the same product, most dangerous first.

CVE-2026-53519CRITICALNezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_keyEPSS 2.3%CVE-2026-62283CRITICALNezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership checkEPSS 0.6%CVE-2026-46716CRITICALNezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cronEPSS 0.5%CVE-2026-59155MEDIUMNezha Monitoring: DDNS and Notification credential exposure via unredacted list APIEPSS 0.5%CVE-2026-100394MEDIUMNezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantEPSS 0.4%CVE-2026-53522MEDIUMNezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoSEPSS 0.4%
References
https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0fhttps://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61ehttps://github.com/nezhahq/nezha/security/advisories/GHSA-hpfr-cmgc-f455https://www.vulncheck.com/advisories/nezha-2.2.5-before-2.3.15-information-disclosure-via-ddns-list-endpoint