CVE-2026-111386
Last modified
CVE-2026-111386 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers..
Description
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-111386?
How severe is CVE-2026-111386?
How do I fix CVE-2026-111386?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-111380FreeRDP from 3.29.0 before 3.32.0 contains an integer overfl…8.8
- CVE-2026-111381FreeRDP before 3.32.0 contains a heap buffer overflow vulner…7.3
- CVE-2026-111382FreeRDP before 3.32.0 contains a client-side heap out-of-bou…8.8
- CVE-2026-111383Nezha from 2.0.13 before 2.3.15 contains a resource exhausti…6.5
- CVE-2026-111384Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulne…6.5
- CVE-2026-111385Nezha from 2.1.0 before 2.3.15 contains a host header inject…4.8
- CVE-2026-111387Nezha from 2.2.5 before 2.3.15 contains an information discl…6.5
- CVE-2026-111388Frappe Framework before 15.120.0 and 16.x before 16.33.0 doe…5.4
- CVE-2026-111389Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16…7.7
- CVE-2026-11139Inappropriate implementation in Paint in Google Chrome prior…6.5
- CVE-2026-111390Erupt through 2.3.0 contains an HQL injection vulnerability …5.3
- CVE-2026-111391SGLang 0.5.10 through 0.5.22 contains a code injection vulne…8.1
Are you affected by CVE-2026-111386?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST