Live › vulnerability › CVE-2026-111386
Go to dashboardNezha versions from 1.7.0 before 2.3.15 leak which server IDs belong to other users through differing responses from the server config endpoints. An authenticated member can sweep sequential IDs and tell 'permission denied' apart from success to map other users' servers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a multi-user Nezha dashboard where members can log in and each member should only see their own servers. A single-user instance has no other tenants to enumerate, so the exposure is limited there.
No product ranges from the sources yet.
unknown for the exact command, the sources do not say how it is deployed.2.3.15 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.
This page as .md · .json · in your agent: get_signal("CVE-2026-111386")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.