CVE-2026-111385 in Nezha
Summary
by MITRE • 10/16/2026
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Nezha versions prior to 2.3.15 represents a critical server-side request forgery flaw rooted in the improper validation of HTTP headers during file transfer operations. Specifically, the mintTransferTool component constructs download and upload URLs by directly incorporating the value of the Host header without performing adequate sanitization or verification against an allowlist of trusted domains. This architectural oversight allows an attacker who can manipulate the Host header within a victim's Managed Cloud Provider request to inject arbitrary hostnames into the generated transfer links. The core technical flaw lies in the assumption that the incoming Host header accurately reflects the intended destination, ignoring the reality that this header is easily spoofable by clients or intermediaries under certain network conditions or through malicious client configuration.
The operational impact of this vulnerability is severe, enabling two distinct attack vectors depending on whether the target endpoint handles uploads or downloads. In the context of file uploads, an attacker can redirect the upload destination to a server they control. This allows for the interception and theft of sensitive data being uploaded by legitimate users, effectively turning the Nezha service into a proxy for data exfiltration. For download operations, the vulnerability facilitates token replay attacks. Since the system generates one-time tokens associated with specific URLs built from the injected Host header, an attacker can capture these tokens or manipulate the URL structure to gain unauthorized access to files that should remain private. This capability undermines the integrity and confidentiality guarantees provided by the file transfer mechanism.
From a classification perspective, this vulnerability aligns closely with CWE-15: External Control of System or Configuration Name, as it involves manipulating external input (the Host header) to alter system behavior in an unintended manner. It also maps directly to MITRE ATT&CK technique T1048: Exfiltration Over Alternative Protocol, where the compromised service is used to facilitate data exfiltration through manipulated network paths. The lack of strict validation against a predefined set of allowed hosts constitutes a fundamental failure in input validation principles, which are central to secure application design standards such as OWASP Top 10, particularly under categories related to insecure direct object references and server-side request forgery patterns.
To mitigate this vulnerability, immediate action is required by upgrading Nezha to version 2.3.15 or later, where the issue has been addressed through stricter input validation mechanisms. In environments where an upgrade is not immediately feasible, administrators should implement reverse proxy configurations that enforce a fixed Host header value for all incoming requests before they reach the application layer. Additionally, implementing strict allowlists for permitted hostnames in the transfer tool configuration can prevent redirection to unauthorized domains. Regular security audits focusing on how HTTP headers are utilized in URL construction processes will help identify similar latent vulnerabilities across other components of the system.