TI-2026-34848 Aliases CVE-2026-47268 GHSA-6x26-5727-rrm9

Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host

MEDIUM 62CWE-918Published 2026-06-12 · Updated 2026-06-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated Nezha dashboard user can create or update a DDNS profile with provider webhook and configure an arbitrary webhook_url, HTTP method, request body, and headers. When DDNS is triggered for a server that uses that profile, the dashboard process sends the configured request with utils.HttpClient without the SSRF protections used by notification webhooks. This allows a low-privileged authenticated user who controls an owned server/DDNS profile to make the dashboard host issue HTTP requests to loopback or internal network services. The response body is not returned to the attacker in the confirmed path, so this is a blind SSRF / internal state-changing request primitive. This issue has been patched in version 2.0.10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00219 12th percentileScored 2026-11-07

Fix Fixed nezha (nezhahq): 2.0.10github.com/nezhahq/nezha (Go): 2.0.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nezhahq	nezha	0.20.0 to before 2.0.10	2.0.10	Patch available	CNA
—	github.com/nezhahq/nezha (Go)	0.20.0 to before 2.0.10	2.0.10	Patch available	GHSA-6x26-5727-rrm9
—	github.com/naiba/nezha (Go)	0.20.0 and later	—	No fix listed	GHSA-6x26-5727-rrm9

nezha Vendornezhahq Affected 0.20.0 to before 2.0.10 Fixed in 2.0.10 Patch available CNA
github.com/nezhahq/nezha (Go) Vendor— Affected 0.20.0 to before 2.0.10 Fixed in 2.0.10 Patch available GHSA-6x26-5727-rrm9
github.com/naiba/nezha (Go) Vendor— Affected 0.20.0 and later Fixed in — No fix listed GHSA-6x26-5727-rrm9

Remediation

Fix · CNA nezha (nezhahq) Fixed in 2.0.10
Fix · GHSA-6x26-5727-rrm9 github.com/nezhahq/nezha (Go) Fixed in 2.0.10 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-47268
2026-10-03 Alias added: GHSA-6x26-5727-rrm9

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-47268

Other 2

TI-2026-65123 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri CVSS 4.0CRITICAL 9.3
TI-2026-34341 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CVSS 3.1CRITICAL 9.9
TI-2026-34342 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification CVSS 3.1HIGH 7.7
TI-2026-38597 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection CVSS 3.1MEDIUM 6.8
TI-2026-75131 Memory exhaustion in Nezha file manager WebSocket endpoint CVSS 4.0HIGH 7.1
TI-2026-75130 Nezha WebSocket transfer endpoint flaw enables denial of service CVSS 4.0HIGH 7.1

See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences