# github.com/nezhahq/nezha (Go) vulnerabilities 17 known vulnerabilities (4 critical, 4 high, 9 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.14.14 (Jan 10, 2026): affected by 16 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 131 since v1.0.0 (Nov 28, 2024) - Registry: https://pkg.go.dev/github.com/nezhahq/nezha - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-100394: no published release is affected - CVE-2026-101090: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-62283: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-59155: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-53523: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-53522: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-53521: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-53520: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-53519: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-49397: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-49396: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-48119: v1.0.0 to v1.14.14 (through the newest release) - CVE-2026-47124: v1.4.0 to v1.14.14 (through the newest release) - CVE-2026-47120: v1.4.0 to v1.14.14 (through the newest release) - CVE-2026-46717: v1.4.0 to v1.14.14 (through the newest release) - CVE-2026-46716: v1.4.0 to v1.14.14 (through the newest release) - CVE-2026-47268: v1.0.0 to v1.14.14 (through the newest release) ## Advisories (17) ### [CVE-2026-100394](https://cve.now/CVE-2026-100394): Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant - Severity: Medium 6.5 - Published: Oct 14, 2026 - Affected: from 0.0.0-20260628010923-fd31e5f1b0f8, fixed in 0.0.0-20260721131105-c893aa57867d. - Fixed in v1.0.0 (released Nov 28, 2024, 685 days before disclosure, the advisory names 0.0.0-20260721131105-c893aa57867d, which was never published). - The latest release, v1.14.14, is not affected. ### [CVE-2026-101090](https://cve.now/CVE-2026-101090): Nezha through 2.2.3 Host Header Injection via OAuth2 redirect\_uri - Severity: Critical 9.3 - Published: Sep 27, 2026 - Affected: versions 2.2.3; all versions. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-62283](https://cve.now/CVE-2026-62283): Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: from 1.14.13, through 1.14.14; from 2.0.0, fixed in 2.0.10; all versions; from 1.14.13. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-59155](https://cve.now/CVE-2026-59155): Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API - Severity: Medium 6.9 - Published: Jul 10, 2026 - Affected: fixed in 2.2.5; all versions. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-53523](https://cve.now/CVE-2026-53523): Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection - Severity: Medium 6.8 - Published: Jun 12, 2026 - Affected: from 1.0.0, fixed in 2.2.0; from 1.0.0. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-53522](https://cve.now/CVE-2026-53522): Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS - Severity: Medium 6.5 - Published: Jun 12, 2026 - Affected: from 1.0.0, fixed in 2.2.0; from 1.0.0. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-53521](https://cve.now/CVE-2026-53521): Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context - Severity: Medium 6.4 - Published: Jun 12, 2026 - Affected: from 2.0.14, fixed in 2.1.0; all versions. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-53520](https://cve.now/CVE-2026-53520): Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing - Severity: Medium 6.5 - Published: Jun 12, 2026 - Affected: all versions; from 2.0.14, fixed in 2.1.0. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-53519](https://cve.now/CVE-2026-53519): Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt\_secret\_key - Severity: Critical 9.1 - Published: Jun 12, 2026 - Affected: fixed in 2.0.13; all versions. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-49397](https://cve.now/CVE-2026-49397): Nezha Monitoring: Private services (\`EnableShowInService: false\`) are enumerable via per-server endpoints, leaking name and timing data - Severity: Medium 5.3 - Published: Jun 12, 2026 - Affected: all versions; from 2.0.0, fixed in 2.0.14. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-49396](https://cve.now/CVE-2026-49396): Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents - Severity: High 7.1 - Published: Jun 12, 2026 - Affected: from 1.0.0; from 1.0.0, fixed in 2.0.14. - No fix released. The latest release, v1.14.14, is still affected. ### [CVE-2026-48119](https://cve.now/CVE-2026-48119): Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services - Severity: High 7.1 - Published: Jun 12, 2026 - Affected: from 1.0.0, fixed in 1.14.15-0.20260521020202-02129f16fb15; from 0.20.0, fixed in 1.14.15-0.20260521020202-02129f16fb15; from 2.0.0, fixed in 2.0.12. - No fix released. The advisory names 1.14.15-0.20260521020202-02129f16fb15 and 2.0.12 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected. ### [CVE-2026-47124](https://cve.now/CVE-2026-47124): Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members - Severity: Medium 6.5 - Published: Jun 12, 2026 - Affected: from 1.4.0, fixed in 1.14.15-0.20260517034128-05e5da253519. - No fix released. The advisory names 1.14.15-0.20260517034128-05e5da253519 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected. ### [CVE-2026-47120](https://cve.now/CVE-2026-47120): Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) - Severity: High 7.1 - Published: Jun 12, 2026 - Affected: from 1.4.0, fixed in 1.14.15-0.20260517022419-d7526351cf97. - No fix released. The advisory names 1.14.15-0.20260517022419-d7526351cf97 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected. ### [CVE-2026-46717](https://cve.now/CVE-2026-46717): Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification - Severity: High 7.7 - Published: Jun 12, 2026 - Affected: from 1.4.0, fixed in 1.14.15-0.20260517022419-d06d539d34c1. - No fix released. The advisory names 1.14.15-0.20260517022419-d06d539d34c1 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected. ### [CVE-2026-46716](https://cve.now/CVE-2026-46716): Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron - Severity: Critical 9.9 - Published: Jun 12, 2026 - Affected: from 1.4.0, fixed in 1.14.15-0.20260517022419-d7526351cf97. - No fix released. The advisory names 1.14.15-0.20260517022419-d7526351cf97 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected. ### [CVE-2026-47268](https://cve.now/CVE-2026-47268): Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host - Severity: Medium 6.4 - Published: Jun 12, 2026 - Affected: from 0.20.0, fixed in 2.0.10. - No fix released. The advisory names 2.0.10 as the fix, which the registry doesn't have yet. The latest release, v1.14.14, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/nezhahq/nezha Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.