Nezha CVE-2026-111385

Exploitation requires that the attacker control or spoof the HTTP Host header observed on a victim's MCP request to the Nezha dashboard, because mintTransferTool constructs the fs.download_url and fs.upload_url transfer URLs directly from that unvalidated Host header (CWE-601). The attacker must therefore occupy a position that influences the reflected Host value - such as a misconfigured/trusting reverse proxy, DNS rebinding, or a man-in-the-middle on the victim's path - rather than being able to trigger it against a default, properly proxied deployment at will; this is reflected in the AC:H and AT:P metrics. Exploitation is further limited to Nezha versions 2.1.0 through 2.3.14 (fixed in 2.3.15) and depends on the victim actually invoking the MCP transfer tools; impact is constrained to redirected uploads and captured one-time download tokens (low confidentiality/integrity impact), not code execution.

This is a medium-severity issue (vendor CVSS 4.0 base 6.3) whose real-world urgency is tempered by its exploitation requirements. The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) shows that while the vector is network-reachable and requires no privileges (PR:N), it carries both high attack complexity (AC:H) and a present attack requirement (AT:P) - meaning the attacker must be in a position to control or spoof the Host header actually seen on a victim's MCP request, which is not a condition an attacker can satisfy at will. Impact is explicitly limited (VC:L/VI:L/VA:N, no scope change), consistent with token capture and file redirect rather than full system compromise. No EPSS score, no CISA KEV listing, and no public POC were present in the input, so there is no signal of active or imminent mass exploitation; this reads as a legitimate but non-emergency defect rather than a high-CVSS-but-low-real-risk false alarm or a drop-everything priority. Note the only CVSS data supplied is a 4.0 vector - no CVSS 3.1 vector and no EPSS were provided, so cross-signal comparison is limited to the 4.0 metrics and the qualitative exploitation conditions.

An attacker positioned to influence the Host header on a victim's Model Context Protocol (MCP) request to a Nezha dashboard (for example via a misconfigured reverse proxy, DNS rebinding, or a man-in-the-middle position) causes mintTransferTool to build fs.download_url and fs.upload_url pointing at an attacker-controlled host. The victim's file upload is redirected to the attacker, or the one-time download token is captured and replayed to exfiltrate files. No public exploit code was identified in the provided data, and the AC:H/AT:P metrics mean the attacker must already be able to manipulate the observed Host header.