{"id":"CVE-2026-111385","kind":"vulnerability","aliases":["CVE-2026-111385"],"related":[],"title":"Nezha: Host header injection in MCP transfer tool redirects file transfers","description":"Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.","summary":"Nezha versions 2.1.0 through 2.3.14 build file transfer URLs in its mintTransferTool MCP handler from the unvalidated Host header of the incoming request. An attacker who controls the Host header on a victim's MCP request can redirect uploads or capture one-time download tokens and replay them to exfiltrate files.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","nezha","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the Nezha version on the dashboard host with `nezha-dashboard --version` or the image tag in use; affected versions are `2.1.0` through `2.3.14`.\n- Confirm whether the MCP endpoint is reachable from untrusted networks.","fix":"- Upgrade Nezha to `2.3.15` or later.\n- Until upgraded, restrict access to the MCP endpoint to trusted clients and proxies that set a fixed Host header.","status":"open","published_at":"2026-10-16T03:18:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:01:58+00:00","updated_at":"2026-10-25T04:01:58+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:01:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Nezha to `2.3.15` or later.\n- Until upgraded, restrict access to the MCP endpoint to trusted clients and proxies that set a fixed Host header.","reach":"network","title":"Nezha: Host header injection in MCP transfer tool redirects file transfers","impact":"medium","summary":"Nezha versions 2.1.0 through 2.3.14 build file transfer URLs in its mintTransferTool MCP handler from the unvalidated Host header of the incoming request. An attacker who controls the Host header on a victim's MCP request can redirect uploads or capture one-time download tokens and replay them to exfiltrate files.","category":"ai-tooling","nicknames":[],"who_cares":["nezha","self-hosted","mcp"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker captures download tokens and exfiltrates server files.","analyst_note":"Check the NVD entry and the Nezha 2.3.15 release notes to confirm whether authentication is required and whether the MCP server is enabled by default.","how_to_check":"- Check the Nezha version on the dashboard host with `nezha-dashboard --version` or the image tag in use; affected versions are `2.1.0` through `2.3.14`.\n- Confirm whether the MCP endpoint is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams that run a self-hosted Nezha dashboard with its MCP server enabled and reachable by clients whose requests can carry attacker-chosen Host headers. Deployments where the MCP endpoint is only on a trusted internal network with fixed host routing have much less exposure. The sources do not describe whether a valid session is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":3350,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111385':14A,17A '-2026':13A,16A '2.1.0':28B,80C '2.3.14':30B '2.3.15':82C 'ai':19B 'ai-tool':18B 'attack':50B,105C 'build':31B,92C 'captur':66B,123C 'contain':83C 'control':52B,107C 'cve':12A,15A 'download':70B,127C 'exfiltr':76B,133C 'file':10A,32B,77B,120C,134C 'fs.download':93C 'fs.upload':96C 'handler':39B 'header':3A,44B,55B,86C,104C,110C 'host':2A,25B,43B,54B,85C,103C,109C 'incom':47B 'inject':4A,87C 'mcp':6A,21B,38B,60B,116C 'minttransfertool':37B,90C 'nezha':1A,22B,26B,78C 'one':68B,125C 'one-tim':67B,124C 'redirect':9A,63B,119C 'replay':73B,130C 'request':48B,61B,117C 'seen':111C 'self':24B 'self-host':23B 'time':69B,126C 'token':71B,128C 'tool':8A,20B 'transfer':7A,11A,33B,98C 'unvalid':42B,102C 'upload':64B,121C 'url':34B,94C,97C,99C 'version':27B 'victim':58B,114C 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Nezha dashboard with its MCP server enabled and reachable by clients whose requests can carry attacker-chosen Host headers. Deployments where the MCP endpoint is only on a trusted internal network with fixed host routing have much less exposure. The sources do not describe whether a valid session is required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111385","severity":null,"published_at":"2026-10-16T03:18:05+00:00","modified_at":"2026-10-21T03:17:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}