CVE-2026-111386 Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
Authenticated users can enumerate other tenants' server IDs by analyzing differential responses from configuration endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111386?
CVE-2026-111386 is a medium-severity vulnerability in nezhahq nezha, published on 16 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.
Weakness: CWE-204
Which versions are affected by CVE-2026-111386?
How do I fix CVE-2026-111386?
No fix has been published for CVE-2026-111386 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111386 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111386 exists.
Sources
Also known as GHSA-228w-p4h4-6rvw, GHSA-xpxc-2hwp-cv47.