CVE-2026-111385

MEDIUM 4.8

Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

CVSS Score

4.8

EPSS Score

0.0%

EPSS Percentile

0th

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.

CWE	CWE-601
Vendor	nezhahq
Product	nezha
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for nezhahq nezha

Be the first to know when new medium vulnerabilities affecting nezhahq nezha are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

nezhahq / nezha

2.1.0 < 2.3.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nezhahq/nezha/security/advisories/GHSA-rj3w-jrj7-x7c3 github.com: https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f github.com: https://github.com/nezhahq/nezha/commit/c726930833937a0aebb2a924064f236faea889f6 vulncheck.com: https://www.vulncheck.com/advisories/nezha-2.1.0-before-2.3.15-host-header-injection-via-mcp-transfer-tools

Credits

🔍 manus-use