Live › vulnerability › CVE-2026-111387
Go to dashboardNezha versions from 2.2.5 before 2.3.15 leave WebhookURL and WebhookRequestBody unredacted in the listDDNS API. An authenticated user with the nezha:ddns:read scope can call GET /api/v1/ddns and read cleartext third-party tokens stored in every user's DDNS webhook profiles.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Nezha dashboards in the affected range that have DDNS webhook profiles configured. Exposure requires a logged-in account or PAT with the nezha:ddns:read scope, so instances with only a single trusted admin and no shared tokens carry lower practical risk. Instances without DDNS webhooks configured have nothing sensitive to leak from this endpoint.
No product ranges from the sources yet.
nezha-dashboard --version or the dashboard footer; affected if between 2.2.5 and 2.3.14nezha:ddns:read scopeGET /api/v1/ddns as a non-admin token and see whether webhook URLs or bodies appear in cleartext2.3.15 or laternezha:ddns:read from tokens that do not need itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.
This page as .md · .json · in your agent: get_signal("CVE-2026-111387")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.