---
id: "CVE-2026-92210"
kind: "vulnerability"
aliases: ["CVE-2026-92210"]
title: "NoMachine nxhtd: unauthenticated server-side request forgery leaks internal information"
severity: "high"
cvss: 7.2
epss: 0.00327
exploited: false
status: "open"
category: "other"
products: [{"name": "NoMachine", "fixed": ["10.1.7", "9.9.6", "8.27.1"], "affected": "unknown lower bound; below 10.1.7 / 9.9.6 / 8.27.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["nomachine", "other", "remote-desktop", "self-hosted", "ssrf"]
not_affected_if: ["no-nomachine-installed", "no-nomachine-server", "patched-version", "port-4443-blocked", "udp-4443-blocked"]
published_at: "2026-10-21T18:17:31+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:30:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92210", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-92210", "first_seen_at": "2026-10-24T13:15:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:30:11+00:00"}]
---

# NoMachine nxhtd: unauthenticated server-side request forgery leaks internal information

The NoMachine nxhtd web service does not validate a URI before fetching it, so a remote attacker can make the server send requests on their behalf. This can expose information from resources the server can reach, such as internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NoMachine affected unknown lower bound; below 10.1.7 / 9.9.6 / 8.27.1 fixed 10.1.7, 9.9.6, 8.27.1

## How to check

- Run the NoMachine server's version check (nxserver --version, or the About dialog) and compare to fixed 10.1.7 / 9.9.6 / 8.27.1
- Check for nxhtd listening on port 4443: ss -ulpn | grep 4443 (ZDI says UDP; also check ss -tlpn | grep 4443)

## Fix

Upgrade NoMachine to 10.1.7, 9.9.6 or 8.27.1 or later on your branch (later releases 10.2.3, 9.10.3, 8.28.2 also exist; vendor says 9.10.3 and 8.28.2 carry further server-side security patches and an updated nxhtd). Per ZDI-26-712.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92210
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-92210
- 2026-10-25T03:30:11+00:00 analyst — ZDI-26-712 (reported by Niels Pfau, Mantodea Security) says fixed in NoMachine 10.1.7, 9.9.6, 8.27.1; vendor KB 8.27.1 notes list an unnumbered 'possible SSRF in Web Player' (TR08X11930), consistent but no CVE cited. Affected lower bounds unknown. ZDI says port 4443 is the default; nxhtd ships in commercial server packages. No exploitation or PoC found. Nothing marked verified (fix comes from ZDI, not a vendor page naming the CVE).

## Documents

- [advisory] ZDI-26-712 NoMachine nxhtd SSRF https://www.zerodayinitiative.com/advisories/ZDI-26-712/
- [fix] NoMachine 8.27.1 release notes https://kb.nomachine.com/SU09X00289
- [mentions] NoMachine 9.10.3 release notes https://kb.nomachine.com/SU10X00291

## From the sources

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on UDP port 4443 by default. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to initiate requests in the context of the service account. Was ZDI-CAN-31619.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_