What’s Vulnerable › Vulnerabilities

CVE-2026-111386: Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-16 · updated 2026-10-16
• Weakness: CWE-204

Description

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.

Affected products

• nezhahq nezha: from 1.7.0 before 2.3.15 — fixed in 2.3.15

How to fix

Upgrade to a fixed version: nezhahq nezha 2.3.15. Check the vendor advisory for mitigations.

References

• https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
• https://github.com/nezhahq/nezha/security/advisories/GHSA-228w-p4h4-6rvw
• https://www.vulncheck.com/advisories/nezha-1.7.0-before-2.3.15-cross-tenant-server-id-enumeration-via-getserverconfig

Get alerted when CVE-2026-111386 or the next vulnerability affects your stack