Medium severity · published Oct 16, 2026
CVE-2026-111386
Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
nezha · nezhahq
1.7.0 before 2.3.15 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111386
github.com
https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
github.com
https://github.com/nezhahq/nezha/security/advisories/GHSA-228w-p4h4-6rvw
www.vulncheck.com
https://www.vulncheck.com/advisories/nezha-1.7.0-before-2.3.15-cross-tenant-server-id-enumeration-via-getserverconfig
More from nezha
9.9
CVE-2026-62283
Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
9.9
CVE-2026-46716
Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
9.8
CVE-2026-101090
Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri
9.1
CVE-2026-53519
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
7.7
CVE-2026-46717
Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification