CVE-2026-111385 MEDIUM

CVE-2026-111385: Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools

Vendor Nezhahq

Product nezha

Weakness CWE-601 · Open redirect

Published October 16, 2026

Last update October 16, 2026

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.

Key dates

02Disclosure timeline

October 16, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-111385 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/601.html AskarLabs — CWE-601 write-up URL Redirection to Untrusted Site (Open Redirect)

Related vulnerabilities

04Related CVE

CVE-2025-14451 Solutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter CVE-2025-67585 WordPress Flexmls® IDX plugin <= 3.15.7 - Open Redirection vulnerability CVE-2025-30954 WordPress WP Gravity Forms Constant Contact Plugin <= 1.1.0 - Open Redirection Vulnerability CVE-2025-30781 WordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin <= 3.7.1 - Open Redirection Vulnerability CVE-2026-49059 WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability