CVE-2026-101089
published 2026-09-27CVE-2026-101089: Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of…
PriorityP412low3.1CVSS 3.1
AVNACHPRLUINSUCLINAN
EPSS
0.15%
4.1th percentile
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nezhahq | nezha | < 2.2.7 | 2.2.7 |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv4.02.3LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
nezhahq Nezha up to 2.2.6 Profile Endpoint /api/v1/profile weak password hash (EUVD-2026-88024)
vuldb·2026-09-27·CVSS 3.1
CVE-2026-101089 [LOW] nezhahq Nezha up to 2.2.6 Profile Endpoint /api/v1/profile weak password hash (EUVD-2026-88024)
A vulnerability has been found in nezhahq Nezha up to 2.2.6 and classified as problematic. Affected is an unknown function of the file /api/v1/profile of the component Profile Endpoint. This manipulation causes password hash with insufficient computational effort.
The identification of this vulnerability is CVE-2026-101089. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users.
ghsa_unreviewed·2026-09-27
CVE-2026-101089 [LOW] CWE-522 Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users.
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-27
Published