---
id: "CVE-2026-111385"
kind: "vulnerability"
aliases: ["CVE-2026-111385"]
title: "Nezha: Host header injection in MCP transfer tool redirects file transfers"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "mcp", "nezha", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-16T03:18:05+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:01:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111385", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Nezha: Host header injection in MCP transfer tool redirects file transfers

Nezha versions 2.1.0 through 2.3.14 build file transfer URLs in its mintTransferTool MCP handler from the unvalidated Host header of the incoming request. An attacker who controls the Host header on a victim's MCP request can redirect uploads or capture one-time download tokens and replay them to exfiltrate files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Nezha version on the dashboard host with `nezha-dashboard --version` or the image tag in use; affected versions are `2.1.0` through `2.3.14`.
- Confirm whether the MCP endpoint is reachable from untrusted networks.

## Fix

- Upgrade Nezha to `2.3.15` or later.
- Until upgraded, restrict access to the MCP endpoint to trusted clients and proxies that set a fixed Host header.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111385

## From the sources

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_