These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-111387 is an information disclosure vulnerability in Nezha versions from 2.2.5 before 2.3.15. Authenticated users with nezha:ddns:read scope can retrieve third-party credentials via the GET /api/v1/ddns endpoint due to omitted redaction of WebhookURL and WebhookRequestBody in listDDNS. This issue allows admins or PATs to read cleartext tokens embedded in DDNS webhook profiles.
CVE-2026-111386 is a medium-severity information disclosure vulnerability in Nezha versions 1.7.0 before 2.3.15. Authenticated members can enumerate other tenants' server IDs through differential responses when sweeping sequential IDs against getServerConfig and setServerConfig. This allows distinguishing 'permission denied' from success payloads to map other users' servers.
CVE-2026-111385 is a host header injection vulnerability in Nezha's mintTransferTool, affecting versions from 2.1.0 before 2.3.15. An attacker controlling the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files. Defenders should assess exposure, prioritize remediation, and verify affected versions and inventory.
CVE-2026-111384 is a high-severity vulnerability in Nezha 1.0.0 before 2.3.15, allowing authenticated users with file manager scopes to cause a memory exhaustion via an unbounded WebSocket endpoint. This issue can lead to an out-of-memory (OOM) kill, dropping all agent monitoring. The vulnerability is caused by the fmStream not calling SetReadLimit, leaving message size unbounded. This allows an attacker [truncated]
CVE-2026-111383 is a resource exhaustion vulnerability in Nezha versions from 2.0.13 before 2.3.15. Authenticated users can cause a denial of service by opening unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint, exhausting system resources. This issue allows attackers to hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, leading to the exh [truncated]
A single low-privilege `RoleMember` can take the entire Nezha dashboard offline, and with it every tenant's web UI, REST API, and agent connections, by racing two ordinary operations on their own service. The crash is a nil pointer dereference in the service-monitor worker at `service/singleton/servicesentinel.go:601`. The worker checks a service exists under one lock and later writes to two pointer-value [truncated]
CVE-2026-105113 is a high-severity vulnerability in Nezha Dashboard versions 1.8.0 before 2.3.13. An authenticated non-admin member can exploit an improper locking issue, causing a deadlock in the alerting subsystem and potentially leading to memory exhaustion through blocking requests. This can disrupt alerting and monitoring capabilities, impacting defenders' ability to respond to issues. The vulnerabil [truncated]
CVE-2026-105112 is a medium-severity vulnerability in Nezha versions 1.8.0 before 2.3.13. It allows authenticated non-admin users to deadlock the alerting subsystem by concurrently calling specific endpoints with oversized ID lists, potentially killing alert delivery until a restart. This issue arises from a lock-order inversion in the UpdateGroup and DeleteGroup functions. Defenders should assess their e [truncated]
Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider} reflects the attacker-supplied HTTP Host header into the redirect_uri sent to the identity provider instead of falling back to the configured install_host. An attacker who induces a victim to begin OAuth2 login via a request that reaches [truncated]
CVE-2026-101089 is an information disclosure vulnerability in Nezha before 2.2.7. The vulnerability exists in the GET /api/v1/profile endpoint, which returns the bcrypt-hashed password field of authenticated users. This allows attackers to extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.
CVE-2026-101088 is a denial-of-service vulnerability affecting Nezha versions between 2.2.11 and 2.3.1. An authenticated user with the member role can cause a panic and crash the entire instance by deleting a server while a sentinel worker is processing it. This issue arises from an incomplete fix for a previously reported nil dereference denial of service. The sentinel worker reuses an already-captured, [truncated]
CVE-2026-101087 is a vulnerability in Nezha versions 2.0.10 through 2.3.2 that allows an authenticated user to bypass the denylist for webhook URLs, potentially causing the dashboard to issue requests to restricted IPv6 endpoints. The issue arises from the denylist not covering IPv6 transition ranges, specifically the 6to4 prefix 2002::/16 and the local-use IPv4/IPv6 translation prefix 64:ff9b:1::/48. Thi [truncated]
CVE-2026-101086 debrief based on the supplied source corpus. Nezha Dashboard versions before 2.3.5 are vulnerable due to insufficient restriction of service monitor task types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. This could lead to command execution or Agent configuration tasks within their authorization scope. Defenders shou [truncated]
CVE-2026-101085 debrief based on the supplied source corpus. The CVE record was published on 2026-09-27T21:17:02.307Z and has not been modified since then. This vulnerability affects Nezha installations prior to version 2.3.8, allowing authenticated non-administrator users to create malformed alert rules that trigger unrecovered panics in the alert evaluator goroutine, potentially disrupting monitoring an [truncated]
Nezha Monitoring, a self-hostable and lightweight tool for monitoring servers and websites, has a critical vulnerability in versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. The issue arises from insufficient binding of stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user. This allows an authenticated RoleMember to potentially attach to another user's termi [truncated]
Nezha Monitoring, a self-hostable and lightweight tool for monitoring servers and websites, had an issue in versions prior to 2.2.5. The GET /api/v1/ddns and GET /api/v1/notification endpoints returned full resource objects, including plaintext third-party API credentials. This exposure risked sensitive information such as Cloudflare API tokens, TencentCloud SecretKeys, and webhook URLs with embedded bot [truncated]
Nezha Monitoring, a self-hostable monitoring and O&M tool, has a host header injection vulnerability in versions 1.0.0 to before 2.2.0 due to improper validation in the getRedirectURL function. This issue allows attackers to inject malicious URLs via the Host header, potentially leading to security issues such as unauthorized access or data breaches. The vulnerability has been patched in version 2.2.0, an [truncated]
CVE-2026-53522 is a vulnerability in Nezha Monitoring, a self-hostable, lightweight tool for monitoring servers and websites. The issue affects versions from 1.0.0 to before 2.2.0 and involves the exposure of two endpoints that create long-lived WebSocket streams to monitored agents without proper rate limiting or connection caps. This could potentially lead to resource exhaustion. The vulnerability has b [truncated]
Nezha Monitoring is a self-hostable, lightweight tool for monitoring servers and websites. A vulnerability exists in versions 2.0.14 to before 2.1.0, where the PATCH /server/{id} endpoint accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the [truncated]
CVE-2026-53520 is a medium-severity vulnerability in Nezha Monitoring, a self-hostable, lightweight tool for monitoring servers and websites. Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing from version 2.0.14 to before version 2.1.0. This issue has been patched in version 2.1.0. The vulnerability allows authenticated users to potentially preempt dashboard ro [truncated]
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves [truncated]
CVE-2026-49397 debrief: Private services in Nezha Monitoring are enumerable via per-server endpoints, leaking name and timing data. This issue affects Nezha Monitoring instances with private services (EnableShowInService: false), allowing service enumeration and potential information disclosure. Defenders responsible for Nezha Monitoring instances should assess exposure and apply patches or mitigations to [truncated]
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Nezha Monitoring, a self-hostable, lightweight tool for monitoring servers and websites. The issue exists from version 0.20.0 up to but not including version 2.0.10. An authenticated user with low privileges can create or update a DDNS profile with a provider webhook. This allows them to configure an arbitrary webhook URL, HTTP method, [truncated]
CVE-2026-47124 is a medium-severity vulnerability in Nezha Monitoring, a self-hostable, lightweight tool for monitoring servers and websites. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by HasPermission, but [truncated]
CVE-2026-47120 is a high-severity vulnerability in Nezha Monitoring, a self-hostable, lightweight monitoring and O&M tool. The issue allows a RoleMember to fire other users' cron tasks via AlertRule.FailTriggerTasks without ownership checks. This vulnerability affects Nezha Monitoring versions from 1.4.0 to before 2.0.8. The issue has been patched in version 2.0.8. The CVSS score for this vulnerability is [truncated]
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler — so a RoleMember user can call them. [truncated]
A critical vulnerability was discovered in Nezha Monitoring, a self-hostable, lightweight monitoring and O&M tool. The vulnerability allows a RoleMember user to create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other te [truncated]