CVE-2026-111385
CVE-2026-111385 · Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.
CVSS 6.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
nezha
- Versions
- ≥ 2.1.0, < 2.3.15: Affected (semver)
- 2.3.15: Not affected (semver)
Update to 2.3.15
Original sources
- https://github.com/nezhahq/nezha/security/advisories/GHSA-rj3w-jrj7-x7c3
- https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
- https://github.com/nezhahq/nezha/commit/c726930833937a0aebb2a924064f236faea889f6
- https://www.vulncheck.com/advisories/nezha-2.1.0-before-2.3.15-host-header-injection-via-mcp-transfer-tools
- https://nvd.nist.gov/vuln/detail/CVE-2026-111385