CVE-2026-111385 nezhahq CVE debrief

Who should care

Defenders responsible for Nezha deployments, particularly those using versions 2.1.0 to 2.3.14, should assess exposure and prioritize remediation. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details and take necessary actions to protect their environments. This includes verifying affected versions, assessing exposure, and applying remediation or compensating controls.

Why it matters

CVE-2026-111385 is a medium-severity vulnerability in Nezha's mintTransferTool that allows attackers to inject malicious URLs via the Host header. Defenders should assess exposure, prioritize remediation, and verify affected versions and inventory.

• Potential redirection of file uploads
• Possible exfiltration of files via one-time download tokens
• Need to verify affected versions and inventory
• Priority for applying remediation or compensating controls

Technical summary

The CVE-2026-111385 vulnerability affects Nezha versions 2.1.0 to 2.3.14 and allows attackers to inject malicious URLs via the Host header, potentially redirecting file uploads or exfiltrating files via one-time download tokens. Defenders should assess exposure, prioritize remediation, and verify affected versions and inventory. The vulnerability is a medium-severity issue, and defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The vulnerability can be mitigated by applying vendor-supported updates or compensating controls.

Defensive priority

Medium priority for defenders to verify affected versions, assess exposure, and apply remediation

Recommended defensive actions

• Verify if Nezha versions 2.1.0 to 2.3.14 are in use and assess exposure
• Apply remediation or compensating controls for affected versions
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but version-specific information and remediation guidance are limited. Defenders should verify affected versions, assess exposure, and apply remediation or compensating controls. The vulnerability affects Nezha versions 2.1.0 to 2.3.14, and attackers can inject malicious URLs via the Host header, potentially redirecting file uploads or exfiltrating files via one-time download tokens.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.