Read the docs
TI-2026-34716 Aliases CVE-2026-47124GHSA-hvv7-hfrh-7gxj

Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members

Priority MEDIUM 62CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by HasPermission, but the WebSocket stream treats the presence of any authenticated user as authorization for the full unfiltered server list. This issue has been patched in version 2.0.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix Fixed nezha (nezhahq): 2.0.9github.com/nezhahq/nezha (Go): 1.14.15-0.20260517034128-05e5da253519

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nezhahqnezha1.4.0 to before 2.0.92.0.9Patch availableCNA
—github.com/nezhahq/nezha (Go)1.4.0 to before 1.14.15-0.20260517034128-05e5da2535191.14.15-0.20260517034128-05e5da253519Patch availableGHSA-hvv7-hfrh-7gxj
  • nezha Vendornezhahq Affected 1.4.0 to before 2.0.9 Fixed in 2.0.9 Patch available CNA
  • github.com/nezhahq/nezha (Go) Vendor— Affected 1.4.0 to before 1.14.15-0.20260517034128-05e5da253519 Fixed in 1.14.15-0.20260517034128-05e5da253519 Patch available GHSA-hvv7-hfrh-7gxj

Remediation

  • Fix · CNA nezha (nezhahq) Fixed in 2.0.9
  • Fix · GHSA-hvv7-hfrh-7gxj github.com/nezhahq/nezha (Go) Fixed in 1.14.15-0.20260517034128-05e5da253519 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47124
  2. 2026-10-03 Alias added: GHSA-hvv7-hfrh-7gxj

References

Advisory 1

Other 2

  • TI-2026-65123 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri CVSS 4.0CRITICAL 9.3
  • TI-2026-34341 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CVSS 3.1CRITICAL 9.9
  • TI-2026-34342 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification CVSS 3.1HIGH 7.7
  • TI-2026-38597 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection CVSS 3.1MEDIUM 6.8
  • TI-2026-75131 Memory exhaustion in Nezha file manager WebSocket endpoint CVSS 4.0HIGH 7.1
  • TI-2026-75130 Nezha WebSocket transfer endpoint flaw enables denial of service CVSS 4.0HIGH 7.1
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences