CVE-2026-111386
Deferred Deferred - Pending Action

Information Disclosure in Nezha from 1.7.0 to 2.3.15

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111386
EUVD
EUVD-2026-102567

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nezhahq nezha 1.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Nezha versions 1.7.0 to 2.3.14 allows authenticated users to disclose other tenants' server IDs by exploiting differential responses in API calls like getServerConfig and setServerConfig. Attackers can map other users' servers by sending sequential requests and observing differences between 'permission denied' and successful responses.

Detection Guidance

This vulnerability can be detected by monitoring for unusual API calls to getServerConfig and setServerConfig endpoints. Attackers may sweep sequential server IDs to identify valid tenants. Check server logs for repeated failed access attempts or differential responses indicating permission checks.

Impact Analysis

An attacker could use this to enumerate and identify other users' servers within the same system, potentially leading to further attacks like unauthorized access, data breaches, or service disruption. The impact is limited to information disclosure and does not directly allow data modification or privilege escalation.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive server information of other tenants, leading to unauthorized data access or privacy breaches. Compliance may be impacted due to insufficient access controls and potential data leakage.

Mitigation Strategies

Upgrade Nezha to version 2.3.15 or later to address the information disclosure flaw. Ensure strict access controls are enforced for API endpoints and implement rate limiting to prevent ID enumeration attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111386. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart