CVE-2026-111387
CVE-2026-111387 · Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
nezha
- Versions
- ≥ 2.2.5, < 2.3.15: Affected (semver)
- 2.3.15: Not affected (semver)
Update to 2.3.15
Original sources
- https://github.com/nezhahq/nezha/security/advisories/GHSA-hpfr-cmgc-f455
- https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
- https://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e
- https://www.vulncheck.com/advisories/nezha-2.2.5-before-2.3.15-information-disclosure-via-ddns-list-endpoint
- https://nvd.nist.gov/vuln/detail/CVE-2026-111387