Nezhahq Nezha vulnerabilities

CVE-2026-105113 [MEDIUM] CWE-667 CVE-2026-105113: Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-defe Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.

CVE-2026-49396 [HIGH] CWE-352 CVE-2026-49396: Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14.

CVE-2026-49397 [MEDIUM] CWE-200 CVE-2026-49397: Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14, private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data. This issue has been patched in version 2.0.14.

CVE-2026-101088 [MEDIUM] CWE-367 CVE-2026-101088: Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentin Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go) contains an incomplete fix for a previously reported nil dereference denial of service (GHSA-qjpp-gffx-2wm9). The 2026-07-21 fix re-validated the service lifecycle under serviceResponseDataStoreLock b

CVE-2026-105112 [MEDIUM] CWE-362 CVE-2026-105112: Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that a Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert de

CVE-2026-111385 [MEDIUM] CWE-601 CVE-2026-111385: Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool th Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltr

CVE-2026-101087 [MEDIUM] CWE-918 CVE-2026-101087: Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notif Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Because such addresses satisfy Go's netip.Addr.IsGlobalUnica

CVE-2026-111386 [MEDIUM] CWE-204 CVE-2026-111386: Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenti Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers

CVE-2026-101089 [LOW] CWE-522 CVE-2026-101089: Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpo Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.