Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck

CVE-2026-101087Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6

Medium 4.3

In plain English

A medium-severity server-side request forgery in nezha from nezhahq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because such addresses satisfy Go's netip.Addr.IsGlobalUnicast check, the URL validator accepted them. An authenticated user able to configure a webhook may be able to cause the dashboard to issue requests to an otherwise restricted IPv6 endpoint, but only where the dashboard's network provides unusual or non-standards-compliant routing for these transition ranges; no direct path to an IPv4 metadata, loopback, or private-network HTTP request has been demonstrated. The issue is fixed in version 2.3.3 (commit d1fcde8e), which blocks both prefixes.

Affected products (as reported)

Vendor	Product	Versions
nezhahq	nezha	2.0.10 – before 2.3.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-jr2j-7hvh-h4q9) vendor-advisory
Patch Commit patch
VulnCheck Advisory: Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 third-party-advisory