CVE-2026-46717: Nezha Monitoring SSRF and Authorization Bypass in Notification API

CVE-2026-46717 · Severity: high · CVSS 8.5 · Published 2026-06-12

Nezha Monitoring is a tool used by administrators to monitor the health and status of servers and websites. A security flaw allows users with low-level 'Member' accounts to bypass intended restrictions and force the monitoring server to make unauthorized requests to internal network resources. This could allow an attacker to view sensitive internal data, access cloud metadata services, or cause a service outage by exhausting the server's memory.

Technologies: github.com/nezhahq/nezha (Go), NezhaHQ Nezha. Vendors: Go, NezhaHQ.

Quick answers

Is CVE-2026-46717 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46717 being exploited in the wild.
How severe is CVE-2026-46717?
High severity, with a CVSS score of 8.5, published 12 June 2026.
Which products and versions are affected?
github.com/nezhahq/nezha (Go) >= 1.4.0, < 1.14.15-0.20260517022419-d06d539d34c1, SEMVER:introduced=1.4.0,fixed=1.14.15-0.20260517022419-d06d539d34c1; NezhaHQ Nezha >= 1.4.0, < 2.0.8; NezhaHQ Nezha Monitoring >= 1.4.0, < 2.0.8.
Is there a fix for CVE-2026-46717?
Yes. github.com/nezhahq/nezha (Go): upgrade to 1.14.15-0.20260517022419-d06d539d34c1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46717 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46717?
Check whether you run github.com/nezhahq/nezha (Go), NezhaHQ Nezha or NezhaHQ Nezha Monitoring at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/nezhahq/nezha (Go): upgrade to 1.14.15-0.20260517022419-d06d539d34c1 or later
    go get github.com/nezhahq/nezha@v1.14.15-0.20260517022419-d06d539d34c1

Technical details

An Incorrect Authorization (CWE-863) and Server-Side Request Forgery (SSRF) (CWE-918) vulnerability exists in Nezha Monitoring versions 1.4.0 through 2.0.7. The notification routes (POST /api/v1/notification and PATCH /api/v1/notification/:id) are incorrectly mapped to 'commonHandler' instead of 'adminHandler', allowing users with 'RoleMember' privileges to access them. These handlers use a 'Send()' function that issues synchronous HTTP requests to attacker-controlled URLs. If the target returns a non-2xx status code, the application reads the entire response body without a size limit using 'io.ReadAll' and reflects it back to the user. This allows for internal network scanning, data exfiltration from internal services (including cloud metadata endpoints), and potential Denial of Service (DoS) via memory exhaustion. The issue is patched in version 2.0.8.

Affected products

  • nezhahq Nezha Monitoring >= 1.4.0, < 2.0.8

Identifiers

  • CVE-2026-46717
  • GHSA-w4g9-mxgg-j532
  • GO-2026-5687

Timeline

  • 2026-05-17: advisory: Initial GitHub security advisory published
  • 2026-06-12: disclosed: CVE-2026-46717 published to NVD
  • 2026-06-12: patched: Fix released in version 2.0.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.