CVE-2026-101087

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because such addresses satisfy Go's netip.Addr.IsGlobalUnicast check, the URL validator accepted them. An authenticated user able to configure a webhook may be able to cause the dashboard to issue requests to an otherwise restricted IPv6 endpoint, but only where the dashboard's network provides unusual or non-standards-compliant routing for these transition ranges; no direct path to an IPv4 metadata, loopback, or private-network HTTP request has been demonstrated. The issue is fixed in version 2.3.3 (commit d1fcde8e), which blocks both prefixes.

• CWE-918

• https://github.com/nezhahq/nezha/commit/d1fcde8e
• https://github.com/nezhahq/nezha/security/advisories/GHSA-jr2j-7hvh-h4q9
• https://www.vulncheck.com/advisories/nezha-2.0.10-through-2.3.2-ssrf-denylist-bypass-ipv6

Published

Sep 27, 2026

Last Modified

Sep 28, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-101081A security flaw has been discovered in D-Link DI-8400 16.07.…9.1
• CVE-2026-101082A weakness has been identified in PMWeb 7.x/8.x/2025.x. This…5.3
• CVE-2026-101083A security vulnerability has been detected in PMWeb v7.x/v8.…5.3
• CVE-2026-101084obot versions before v0.21.1 fail to enforce Access Control …9.6
• CVE-2026-101085Nezha before 2.3.8 fails to validate alert rule type and dur…6.5
• CVE-2026-101086Nezha Dashboard versions before 2.3.5 fail to restrict servi…6.5
• CVE-2026-101088Nezha is a server and website monitoring tool. In versions >…5.3
• CVE-2026-101089Nezha before 2.2.7 contains an information disclosure vulner…3.1
• CVE-2026-10109IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is …9.8
• CVE-2026-101090Nezha 2.2.3 contains a Host header injection regression in t…9.8
• CVE-2026-101098A security vulnerability has been detected in ag-ui-protocol…4.3
• CVE-2026-101099A vulnerability was detected in ag-ui-protocol ag-ui up to 2…4.3