Nezhahq vulnerabilities
30 CVEs and advisories name Nezhahq as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-120046Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History
- CVE-2026-111387Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
- CVE-2026-111386Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
- CVE-2026-111385Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
- CVE-2026-111384Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket
- CVE-2026-111383Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket
- CVE-2026-100394Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
- CVE-2026-105113Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock
- CVE-2026-105112Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints
- CVE-2026-101090Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri
- CVE-2026-101089Nezha before 2.2.7 Information Disclosure via /api/v1/profile
- CVE-2026-101088Nezha before 2.3.1 Denial of Service via Concurrent Server Delete
- CVE-2026-101087Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6
- CVE-2026-101086Nezha Dashboard before 2.3.5 Task Type Validation Bypass
- CVE-2026-101085Nezha before 2.3.8 Denial of Service via Alert Rule
- CVE-2026-62283Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
- CVE-2026-59155Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API
- CVE-2026-53523Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
- CVE-2026-53522Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS
- CVE-2026-53521Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
- CVE-2026-53520Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
- CVE-2026-53519Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
- CVE-2026-49397Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data
- CVE-2026-49396Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents
- CVE-2026-48119Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services
- CVE-2026-47124Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members
- CVE-2026-47120Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)
- CVE-2026-46717Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification
- CVE-2026-46716Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
- CVE-2026-47268Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host