Skip to contentNezhahq Nezha vulnerabilities
- nezhahq nezhaNezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation FlawsCVE-2026-1263078.7 High
- nezhahq nezhaNezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service HistoryCVE-2026-1200466.0 Medium
- nezhahq nezhaNezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List EndpointCVE-2026-1113877.1 High
- nezhahq nezhaNezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfigCVE-2026-1113865.3 Medium
- nezhahq nezhaNezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer ToolsCVE-2026-1113856.3 Medium
- nezhahq nezhaNezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocketCVE-2026-1113847.1 High
- nezhahq nezhaNezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocketCVE-2026-1113837.1 High
- nezhahq nezhaNezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantCVE-2026-100394Fix available6.5 Medium
- nezhahq nezhaNezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex DeadlockCVE-2026-1051137.1 High
- nezhahq nezhaNezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpointsCVE-2026-1051126.0 Medium
- nezhahq nezhaNezha before 2.2.7 Information Disclosure via /api/v1/profileCVE-2026-1010892.3 Low
- nezhahq nezhaNezha before 2.3.1 Denial of Service via Concurrent Server DeleteCVE-2026-1010886.0 Medium
- nezhahq nezhaNezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6CVE-2026-1010875.3 Medium
- nezhahq nezhaNezha Dashboard before 2.3.5 Task Type Validation BypassCVE-2026-1010867.1 High
- nezhahq nezhaNezha before 2.3.8 Denial of Service via Alert RuleCVE-2026-1010857.1 High
- nezhahq nezhaNezha through 2.2.3 Host Header Injection via OAuth2 redirect_uriCVE-2026-1010909.3 Critical
- nezhahq nezhaNezha Monitoring: DDNS and Notification credential exposure via unredacted list APICVE-2026-59155Fix available6.9 Medium
- nezhahq nezhaNezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership checkCVE-2026-62283Fix available9.9 Critical
- nezhahq nezhaNezha Monitoring: OAuth2 Redirect URL — Host Header InjectionCVE-2026-53523Fix available6.8 Medium
- nezhahq nezhaNezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoSCVE-2026-53522Fix available6.5 Medium
- nezhahq nezhaNezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile contextCVE-2026-53521Fix available6.4 Medium
- nezhahq nezhaNezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routingCVE-2026-53520Fix available6.5 Medium
- nezhahq nezhaNezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_keyCVE-2026-53519Public exploitFix available9.1 Critical
- nezhahq nezhaNezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing dataCVE-2026-49397Fix available5.3 Medium
- nezhahq nezhaNezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agentsCVE-2026-49396Fix available7.1 High
- nezhahq nezhaNezha Monitoring: Authenticated agents can forge service-monitor results for other users' servicesCVE-2026-48119Fix available7.1 High
- nezhahq nezhaNezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard hostCVE-2026-47268Fix available6.4 Medium
- nezhahq nezhaNezha WebSocket server stream discloses cross-tenant server telemetry to authenticated membersCVE-2026-47124Fix available6.5 Medium
- nezhahq nezhaNezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cronCVE-2026-46716Public exploitFix available9.9 Critical
- nezhahq nezhaNezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)CVE-2026-47120Fix available7.1 High
- nezhahq nezhaNezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notificationCVE-2026-46717Fix available7.7 High