CVE-2026-101089 nezhahq CVE debrief

Who should care

Defenders responsible for Nezha instances should assess exposure and implement compensating controls to mitigate the risk of password hash disclosure. This includes verifying if the Nezha instance is running version 2.2.7 or later, reviewing relevant monitoring, detection, and logs for exposed assets, and tracking exceptions and retesting remediated assets. Additionally, defenders should prioritize verifying exposure and implementing compensating controls,

Why it matters

CVE-2026-101089 is an information disclosure vulnerability in Nezha before 2.2.7 that allows attackers to extract bcrypt-hashed password fields, potentially leading to offline cracking attacks. Defenders responsible for Nezha instances should assess exposure and implement compensating controls to mitigate the risk.

• Password hash disclosure can lead to offline cracking attacks.
• The lack of rate limiting and audit trail constraints can facilitate brute-force attacks.

Technical summary

The vulnerability exists in the GET /api/v1/profile endpoint of Nezha before 2.2.7, which returns the bcrypt-hashed password field of authenticated users. This allows attackers to extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints. Defenders should prioritize verifying exposure and implementing compensating controls to mitigate the risk of password hash disclosure. The CVE record and NVD entry provide limited information about the vulnerability. The Nezha vendor has released a security advisory (GHSA-8jhq-g4gw-rv5f) and VulnCheck has published an advisory detailing the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls to mitigate the risk of password hash disclosure.

Recommended defensive actions

• Verify exposure by checking if the Nezha instance is running version 2.2.7 or later.
• Implement compensating controls to mitigate the risk of password hash disclosure, such as rate limiting and audit trail constraints.
• Monitor for potential offline cracking attacks and implement additional security measures to prevent such attacks.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Nezha vendor has released a security advisory (GHSA-8jhq-g4gw-rv5f) and VulnCheck has published an advisory detailing the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.