CVE-2026-46716

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9
https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Nezha Monitoring es una herramienta autoalojable, ligera, de monitoreo de servidores y sitios web, y de O&M. Desde la versión 1.4.0 hasta antes de la versión 2.0.8, un usuario RoleMember puede crear una tarea cron programada con Cover=CronCoverAll, Servers=[] y un Comando arbitrario. En cada ciclo del programador, el panel de control envía ese comando a cada servidor en el mapa global ServerShared - incluyendo servidores que pertenecen a otros inquilinos (servidores del administrador, servidores de otros miembros). Cada agente ejecuta el comando y devuelve la salida, la cual es luego enviada al propio NotificationGroup del atacante ? webhook controlado por el atacante. Este problema ha sido parcheado en la versión 2.0.8.

Information

Published : 2026-06-12 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-46716

Mitre link : CVE-2026-46716

CVE.ORG link : CVE-2026-46716

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-269

Improper Privilege Management

CWE-862

Missing Authorization

{"id": "CVE-2026-46716", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46716", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-15T17:06:02.929846Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"status": "affected", "version": ">= 1.4.0, < 2.0.8"}]}]}], "published": "2026-06-12T22:16:50.810", "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9", "source": "security-advisories@github.com"}, {"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map \u2014 including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup \u2192 attacker-controlled webhook. This issue has been patched in version 2.0.8."}, {"lang": "es", "value": "Nezha Monitoring es una herramienta autoalojable, ligera, de monitoreo de servidores y sitios web, y de O&M. Desde la versi\u00f3n 1.4.0 hasta antes de la versi\u00f3n 2.0.8, un usuario RoleMember puede crear una tarea cron programada con Cover=CronCoverAll, Servers=[] y un Comando arbitrario. En cada ciclo del programador, el panel de control env\u00eda ese comando a cada servidor en el mapa global ServerShared - incluyendo servidores que pertenecen a otros inquilinos (servidores del administrador, servidores de otros miembros). Cada agente ejecuta el comando y devuelve la salida, la cual es luego enviada al propio NotificationGroup del atacante ? webhook controlado por el atacante. Este problema ha sido parcheado en la versi\u00f3n 2.0.8."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}