Skip to content
OpenAdvisories

Package · Go

github.com/nezhahq/nezha

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.1
    CVE-2026-49396

    Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2…

    nezhahq nezha github.com/nezhahq/nezha Go
  • High 7.1
    CVE-2026-48119

    Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users' services. This issue has been patched in vers…

    nezhahq nezha github.com/nezhahq/nezha github.com/naiba/nezha Go
  • High 7.1
    CVE-2026-47120

    Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check). This issue has been …

    nezhahq nezha github.com/nezhahq/nezha Go
  • High 7.7
    CVE-2026-46717

    Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /…

    nezhahq nezha github.com/nezhahq/nezha Go