CVE-2026-101089: Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-27 · updated 2026-09-28
Weakness: CWE-522

Description

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.

Affected products

nezhahq nezha: before 2.2.7 — fixed in 2.2.7

How to fix

Upgrade to a fixed version: nezhahq nezha 2.2.7. Check the vendor advisory for mitigations.

References

https://github.com/nezhahq/nezha/security/advisories/GHSA-8jhq-g4gw-rv5f
https://www.vulncheck.com/advisories/nezha-before-2.2.7-information-disclosure-via-api-v1-profile

Get alerted when CVE-2026-101089 or the next vulnerability affects your stack