CVE-2026-101089

Name of the Vulnerable Software and Affected Versions Nezha versions prior to 2.2.7

Description An information disclosure issue exists where the 'GET /api/v1/profile' endpoint returns the bcrypt-hashed password field of authenticated users. This allows attackers to extract password hashes and perform offline cracking attacks without being hindered by rate limiting or audit trail constraints.

Recommendations Update to version 2.2.7 or later. As a temporary workaround, restrict access to the 'GET /api/v1/profile' endpoint to minimize the risk of exploitation.