{"id":"CVE-2026-111387","kind":"vulnerability","aliases":["CVE-2026-111387"],"related":[],"title":"Nezha: DDNS listing exposes cleartext webhook credentials to authenticated users","description":"Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.","summary":"Nezha versions from 2.2.5 before 2.3.15 leave WebhookURL and WebhookRequestBody unredacted in the listDDNS API. An authenticated user with the nezha:ddns:read scope can call GET /api/v1/ddns and read cleartext third-party tokens stored in every user's DDNS webhook profiles.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ddns","monitoring","nezha","other","self-hosted"],"not_affected_if":["managed-hosting","no-ddns-webhooks","patched-version"],"how_to_check":"- Check the Nezha version with `nezha-dashboard --version` or the dashboard footer; affected if between `2.2.5` and `2.3.14`\n- Review which accounts or personal access tokens hold the `nezha:ddns:read` scope\n- Call `GET /api/v1/ddns` as a non-admin token and see whether webhook URLs or bodies appear in cleartext","fix":"- Upgrade Nezha to `2.3.15` or later\n- Rotate any third-party tokens stored in DDNS webhook URLs or request bodies, since they may have been read by users with the scope\n- Remove `nezha:ddns:read` from tokens that do not need it","status":"open","published_at":"2026-10-16T03:18:06+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:36:49+00:00","updated_at":"2026-10-25T03:36:49+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:36:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Nezha to `2.3.15` or later\n- Rotate any third-party tokens stored in DDNS webhook URLs or request bodies, since they may have been read by users with the scope\n- Remove `nezha:ddns:read` from tokens that do not need it","reach":"network","title":"Nezha: DDNS listing exposes cleartext webhook credentials to authenticated users","impact":"medium","summary":"Nezha versions from 2.2.5 before 2.3.15 leave WebhookURL and WebhookRequestBody unredacted in the listDDNS API. An authenticated user with the nezha:ddns:read scope can call GET /api/v1/ddns and read cleartext third-party tokens stored in every user's DDNS webhook profiles.","category":"other","nicknames":[],"who_cares":["nezha","self-hosted","monitoring","ddns"],"confidence":0.7,"needs_auth":"yes","worst_case":"third-party DDNS webhook tokens readable by any scoped user","analyst_note":"Confirm whether the fixed version is 2.3.15 and whether any other endpoints besides GET /api/v1/ddns are affected, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111387.","how_to_check":"- Check the Nezha version with `nezha-dashboard --version` or the dashboard footer; affected if between `2.2.5` and `2.3.14`\n- Review which accounts or personal access tokens hold the `nezha:ddns:read` scope\n- Call `GET /api/v1/ddns` as a non-admin token and see whether webhook URLs or bodies appear in cleartext","needs_analyst":true,"not_affected_if":["no-ddns-webhooks","managed-hosting","patched-version"],"who_is_affected":"Self-hosted Nezha dashboards in the affected range that have DDNS webhook profiles configured. Exposure requires a logged-in account or PAT with the nezha:ddns:read scope, so instances with only a single trusted admin and no shared tokens carry lower practical risk. Instances without DDNS webhooks configured have nothing sensitive to leak from this endpoint.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":3361,"output_tokens":789,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111387':13A,16A '-2026':12A,15A '/api/v1/ddns':51B,105C '2.2.5':27B,69C '2.3.15':29B,71C 'admin':94C 'allow':78C 'api':38B 'authent':9A,40B,79C 'call':49B,103C 'cleartext':5A,54B,108C 'contain':72C 'credenti':7A,86C 'cve':11A,14A 'ddns':2A,17B,45B,64B,99C,115C 'disclosur':75C 'embed':110C 'everi':61B,112C 'expos':4A 'get':50B,104C 'host':23B 'inform':74C 'leav':30B 'list':3A 'listddn':37B,88C 'monitor':18B 'nezha':1A,19B,24B,44B,67C,98C 'omit':89C 'parti':57B,85C 'pat':96C 'profil':66B,117C 'read':46B,53B,100C,107C 'redact':93C 'retriev':82C 'scope':47B,101C 'self':22B 'self-host':21B 'store':59B 'third':56B,84C 'third-parti':55B,83C 'token':58B,109C 'unredact':34B 'user':10A,41B,62B,80C,113C 'version':25B 'vulner':76C 'webhook':6A,65B,116C 'webhookrequestbodi':33B,92C 'webhookurl':31B,90C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Nezha dashboards in the affected range that have DDNS webhook profiles configured. Exposure requires a logged-in account or PAT with the nezha:ddns:read scope, so instances with only a single trusted admin and no shared tokens carry lower practical risk. Instances without DDNS webhooks configured have nothing sensitive to leak from this endpoint.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111387","severity":null,"published_at":"2026-10-16T03:18:06+00:00","modified_at":"2026-10-16T18:17:38+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}