CVE-2026-111387

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111387
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111387.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111387
Aliases
  • GHSA-hpfr-cmgc-f455
Published
2026-10-16T01:17:55Z
Modified
2026-10-17T02:48:20Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
Details

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-212"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111387.json"
}
References

Affected packages

Git / github.com/nezhahq/nezha

Affected ranges

Type
GIT
Repo
https://github.com/nezhahq/nezha
Events
Introduced
39d398066d8c644fe452f74704e34ada6c7ab61e
Fixed
36b742a7e9a81ed782363dd19efd77b7030fbd0f
Fixed
39d398066d8c644fe452f74704e34ada6c7ab61e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.2.5"
        },
        {
            "fixed":  "2.3.15"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111387.json"