CVE-2026-111387
CVE-2026-111387 · Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.
CVSS 7.1 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
nezha
- Versiones
- ≥ 2.2.5, < 2.3.15: Afectada (semver)
- 2.3.15: No afectada (semver)
Actualiza a 2.3.15
Fuentes originales
- https://github.com/nezhahq/nezha/security/advisories/GHSA-hpfr-cmgc-f455
- https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
- https://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e
- https://www.vulncheck.com/advisories/nezha-2.2.5-before-2.3.15-information-disclosure-via-ddns-list-endpoint
- https://nvd.nist.gov/vuln/detail/CVE-2026-111387