CVE-2026-111385
Deferred Deferred - Pending Action

Nezha Host Header Injection in File Transfer URLs

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111385
EUVD
EUVD-2026-102566

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nezhahq nezha 2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nezha versions 2.1.0 to 2.3.14 contain a Host Header Injection vulnerability in the MCP Transfer Tools component. The application builds file transfer URLs (fs.download_url and fs.upload_url) using the unvalidated Host header from incoming requests. Attackers can manipulate the Host header to redirect file uploads or capture one-time download tokens for replay attacks to exfiltrate files.

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious Host header manipulations in MCP transfer tool requests. Check if fs.download_url or fs.upload_url values deviate from expected domains. Inspect Nezha logs for file transfer operations with unusual Host headers or token replay attempts.

Impact Analysis

An attacker could intercept file uploads or download tokens by redirecting traffic through a manipulated Host header. This could lead to unauthorized file exfiltration or data theft if the victim attempts to upload or download files via the vulnerable Nezha instance.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information. Organizations using vulnerable Nezha versions may face compliance violations and potential legal consequences.

Mitigation Strategies
  • Upgrade Nezha to version 2.3.15 or later to patch the vulnerability.
  • Disable MCP transfer tools if not required (default is disabled).
  • Use a reverse proxy to rewrite or validate Host headers before forwarding requests.
  • Bind the Nezha dashboard to a loopback address to restrict access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart