Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
CVE-2026-101089: Nezha 2.2.6 exposes password hashes via API
CVE-2026-101089 · published 21 days ago
Summary
The Nezha monitoring tool (versions before 2.2.7) returns the encrypted password of logged‑in users when the /api/v1/profile URL is called. This lets anyone who can reach the API copy those password strings and try to crack them offline, without any alerts or limits. Update Nezha to version 2.2.7 or newer, or disable that API endpoint until it is patched.
What to do
- Update nezhahq nezha to version 2.2.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nezhahq | nezha | < 2.2.7 |
Original advisory text
Nezha before 2.2.7 Information Disclosure via /api/v1/profile
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.
References
- https://github.com/nezhahq/nezha/security/advisories/GHSA-8jhq-g4gw-rv5f
- https://www.vulncheck.com/advisories/nezha-before-2.2.7-information-disclosure-v...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-1010... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-101089 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.3
Low
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published27 Sep 2026
Updated15 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-101089 · NVD
CVE-2026-101089 · MITRE
CVE-2026-101089 · OSV
GHSA-8jhq-g4gw-rv5f · GHSA
Track software like this
Free during beta