Nezhahq Nezha vulnerabilities, page 2

29 vulnerabilities

Known vulnerabilities in Nezhahq Nezha, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5MediumCVE-2026-53520Gogithub.com/nezhahq · nezha +1 moreNezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routingNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0.EPSS0.40%6.4MediumCVE-2026-53521Gogithub.com/nezhahq · nezha +1 moreNezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile contextNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server. This issue has been patched in version 2.1.0.EPSS0.31%9.1CriticalCVE-2026-53519Gogithub.com/nezhahq · nezha +1 moreNezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_keyNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join("admin-dist", "../data/config.yaml") normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.EPSS2.29%6.8MediumCVE-2026-53523Gogithub.com/nezhahq · nezha +1 moreNezha Monitoring: OAuth2 Redirect URL — Host Header InjectionNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.EPSS0.32%6.5MediumCVE-2026-53522Gogithub.com/nezhahq · nezha +1 moreNezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoSNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: POST /api/v1/terminal → createTerminal() (terminal.go:27-67) and POST /api/v1/file → createFM() (fm.go:28-67). Both call rpc.NezhaHandlerSingleton.CreateStream(streamId, ...) which inserts a new ioStreamContext into an unbounded map[string]*ioStreamContext (s.ioStreams in io_stream.go:59-67). There is no per-user rate limit, no global semaphore, and no per-server connection cap. This issue has been patched in version 2.2.0.EPSS0.41%9.9CriticalCVE-2026-46716Gogithub.com/nezhahq · nezha +1 moreNezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cronNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.EPSS0.49%7.7HighCVE-2026-46717Gogithub.com/nezhahq · nezha +1 moreNezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notificationNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler — so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8.EPSS0.37%7.1HighCVE-2026-49396Gogithub.com/nezhahq · nezha +1 moreNezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agentsNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14.EPSS0.17%5.3MediumCVE-2026-49397Gogithub.com/nezhahq · nezha +1 moreNezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing dataNezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14, private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data. This issue has been patched in version 2.0.14.EPSS0.34%