CVE-2026-111387 nezhahq CVE debrief

Who should care

Defenders responsible for Nezha installations, particularly those with authenticated users having nezha:ddns:read scope, should assess exposure and potential impact. This includes administrators and security teams managing Nezha deployments.

Why it matters

CVE-2026-111387 is an information disclosure vulnerability in Nezha versions from 2.2.5 before 2.3.15, allowing authenticated users to retrieve third-party credentials. Defenders should verify exposure, assess impact, and remediate by upgrading to version 2.3.15 or later.

• Credential disclosure can lead to unauthorized access to third-party services
• Exposure of cleartext tokens in DDNS webhook profiles can compromise connected systems
• Verification of Nezha installations and user scopes is necessary to determine exposure
• Remediation requires upgrading to Nezha version 2.3.15 or later

Technical summary

The Nezha project contains an information disclosure vulnerability in versions from 2.2.5 before 2.3.15. The issue allows authenticated users with nezha:ddns:read scope to retrieve third-party credentials via the GET /api/v1/ddns endpoint. This is due to the listDDNS function omitting redaction of sensitive fields WebhookURL and WebhookRequestBody, which can contain cleartext tokens. The vulnerability can be exploited by admins or PATs to read cleartext tokens embedded in DDNS webhook profiles, potentially leading to unauthorized access to third-party services.

Defensive priority

Defenders should prioritize verifying exposure of Nezha installations to authenticated users with nezha:ddns:read scope and assess the impact of potential credential disclosure.

Recommended defensive actions

• Verify Nezha installations for exposure to authenticated users with nezha:ddns:read scope
• Assess the impact of potential credential disclosure on third-party services
• Remediate by upgrading to Nezha version 2.3.15 or later
• Monitor for unauthorized access to DDNS webhook profiles
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional information is available from source references, including commits and advisories from the Nezha project and Vulncheck. Defenders should verify exposure by reviewing Nezha installations and user scopes, assess potential impact on third-party services, and remediate by upgrading to Nezha version 2.3.15 or later. The information disclosure vulnerability allows authenticated users with nezha:ddns:read scope to retrieve third-party credentials via the GET /api/v

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.