CVE-2026-111385
Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
Published Oct 16, 2026 · updated Oct 16, 2026 · nezhahq nezha
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 16, 2026 · CIRCL Vulnerability Lookup
Detected
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.
Oct 16, 2026 · NIST NVD
Updated
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.
Affected
- vendor nezhahq nezhaversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-111385
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file u
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-111385
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file u
cve.org - NIST NVDVulnerability recordCVE-2026-111385
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file u
nvd.nist.gov