Is CVE-2026-101090 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101090 being exploited in the wild.

How severe is CVE-2026-101090?

Critical severity, with a CVSS score of 9.8, published 27 September 2026.

Which products and versions are affected?

github.com/nezhahq/nezha (Go) SEMVER:introduced=0; Nezha 2.2.3.

Is there a fix for CVE-2026-101090?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101090 attacked?

It is attacked over the network.

Am I affected by CVE-2026-101090?

Check whether you run github.com/nezhahq/nezha (Go) or Nezha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101090: Nezha Host header injection in OAuth2 redirect endpoint

CVE-2026-101090 · Severity: critical · CVSS 9.8 · Published 2026-09-27

Nezha is a monitoring and remote management platform that supports OAuth2-based authentication. Version 2.2.3 contains a regression where the OAuth2 login endpoint reflects attacker-supplied Host headers into the redirect URL sent to identity providers, allowing attackers to intercept authorization codes and take over user accounts. This affects deployments where the optional dashboard_host setting is left empty.

Technologies: github.com/nezhahq/nezha (Go), Nezha. Vendors: Go, Nezha.

Quick answers

Is CVE-2026-101090 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101090 being exploited in the wild.
How severe is CVE-2026-101090?: Critical severity, with a CVSS score of 9.8, published 27 September 2026.
Which products and versions are affected?: github.com/nezhahq/nezha (Go) SEMVER:introduced=0; Nezha 2.2.3.
Is there a fix for CVE-2026-101090?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101090 attacked?: It is attacked over the network.
Am I affected by CVE-2026-101090?: Check whether you run github.com/nezhahq/nezha (Go) or Nezha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Host header injection in /api/v1/oauth2/{provider} (oauth2.go) that occurs when dashboard_host is empty; the endpoint reflects the request Host header into the OAuth2 redirect_uri instead of falling back to install_host. An attacker with network access can forge the Host header on a request to Nezha, causing the OAuth2 provider to redirect the victim's authorization code to an attacker-controlled origin if that origin is accepted by the provider. The issue regresses a prior fix (GHSA-9rc6-8cjv-rcvx) and requires the specific configuration of empty dashboard_host with OAuth2 enabled.

Affected products

Nezha Nezha 2.2.3

Identifiers

CVE-2026-101090
GO-2026-6486

Timeline

2026-09-27: disclosed
2026-06-20: advisory: GitHub Security Advisory GHSA-rf68-8gjr-36q7 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.