All vulnerabilities
CVE-2026-111387GHSA-hpfr-cmgc-f455

Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint

nezhahq nezha
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.3.15Fixed versionCVE List
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.

Text from CVE List

Affected versions 2

  • nezhaaffected: 2.2.5 before 2.3.15CVE List
  • nezhaunaffected: 2.3.15CVE List

References 4