Is CVE-2026-101087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101087 being exploited in the wild.

How severe is CVE-2026-101087?

Medium severity, with a CVSS score of 4.3, published 27 September 2026.

Is there a fix for CVE-2026-101087?

A patch was published on 2026-08-11: Fixed in version 2.3.3 (commit d1fcde8e) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101087 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-101087?

Check whether you run Nezha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101087: Nezha incomplete SSRF denylist for IPv6 transition ranges

CVE-2026-101087 · Severity: medium · CVSS 4.3 · Published 2026-09-27

Nezha is a dashboard application that accepts user-configurable webhook URLs for notifications and dynamic DNS updates. Versions 2.0.10 through 2.3.2 failed to block certain IPv6 address ranges used for IPv4-to-IPv6 transition, allowing an authenticated user to configure webhooks pointing to otherwise restricted endpoints. Successful exploitation requires unusual or non-compliant network routing and does not provide a direct path to metadata or private services in standards-compliant environments.

Technologies: Nezha. Vendors: Nezha.

Quick answers

Is CVE-2026-101087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101087 being exploited in the wild.
How severe is CVE-2026-101087?: Medium severity, with a CVSS score of 4.3, published 27 September 2026.
Which products and versions are affected?: Nezha 2.0.10 through 2.3.2.
Is there a fix for CVE-2026-101087?: A patch was published on 2026-08-11: Fixed in version 2.3.3 (commit d1fcde8e) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101087 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-101087?: Check whether you run Nezha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incomplete SSRF denylist in the webhook URL validator affecting versions 2.0.10 through 2.3.2. The restricted HTTP client failed to block the 6to4 prefix 2002::/16 and local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48 because these ranges satisfy Go's netip.Addr.IsGlobalUnicast check. An authenticated user able to configure webhooks may cause the dashboard to issue requests to restricted IPv6 endpoints, but only in networks with non-standards-compliant routing; version 2.3.3 fixes this by explicitly blocking both prefixes.

Affected products

Nezha Nezha 2.0.10 through 2.3.2

Timeline

2026-09-27: disclosed: CVE-2026-101087 published
2026-08-11: patched: Fixed in version 2.3.3 (commit d1fcde8e)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.