Executive brief
Nezha Monitoring is a tool used by administrators to monitor the health and status of servers and websites. A security flaw allows users with low-level 'Member' accounts to bypass intended restrictions and force the monitoring server to make unauthorized requests to internal network resources. This could allow an attacker to view sensitive internal data, access cloud metadata services, or cause a service outage by exhausting the server's memory.
Technical details
An Incorrect Authorization (CWE-863) and Server-Side Request Forgery (SSRF) (CWE-918) vulnerability exists in Nezha Monitoring versions 1.4.0 through 2.0.7. The notification routes (POST /api/v1/notification and PATCH /api/v1/notification/:id) are incorrectly mapped to 'commonHandler' instead of 'adminHandler', allowing users with 'RoleMember' privileges to access them. These handlers use a 'Send()' function that issues synchronous HTTP requests to attacker-controlled URLs. If the target returns a non-2xx status code, the application reads the entire response body without a size limit using 'io.ReadAll' and reflects it back to the user. This allows for internal network scanning, data exfiltration from internal services (including cloud metadata endpoints), and potential Denial of Service (DoS) via memory exhaustion. The issue is patched in version 2.0.8.
Affected products
- nezhahq Nezha Monitoring >= 1.4.0, < 2.0.8
Timeline
- 2026-05-17: advisory: Initial GitHub security advisory published
- 2026-06-12: disclosed: CVE-2026-46717 published to NVD
- 2026-06-12: patched: Fix released in version 2.0.8