Is CVE-2026-47124 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47124 being exploited in the wild.

How severe is CVE-2026-47124?

Medium severity, with a CVSS score of 6.5, published 12 June 2026.

Which products and versions are affected?

github.com/nezhahq/nezha (Go) >= 1.4.0, = 1.4.0, = 1.4.0, < 2.0.9.

Is there a fix for CVE-2026-47124?

Yes. github.com/nezhahq/nezha (Go): upgrade to 1.14.15-0.20260517034128-05e5da253519 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47124 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47124?

Check whether you run github.com/nezhahq/nezha (Go) or NezhaHQ Nezha Monitoring at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47124: Nezha Monitoring Information Disclosure in Server-Status WebSocket

Q: Is there a fix for CVE-2026-47124?

Yes. github.com/nezhahq/nezha (Go): upgrade to 1.14.15-0.20260517034128-05e5da253519 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47124 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47124?

Check whether you run github.com/nezhahq/nezha (Go) or NezhaHQ Nezha Monitoring at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47124 · Severity: medium · CVSS 6.5 · Published 2026-06-12

Nezha Monitoring is a tool used by administrators to track the health and performance of servers and websites. A security flaw allows any registered user to view detailed technical data and live performance metrics for all servers on the system, including those belonging to other users or organizations. This could allow an unauthorized person to see sensitive infrastructure details, usage patterns, and the operational status of servers they should not have access to.

Technologies: github.com/nezhahq/nezha (Go), NezhaHQ Nezha Monitoring. Vendors: Go, NezhaHQ.

Quick answers

Is CVE-2026-47124 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47124 being exploited in the wild.
How severe is CVE-2026-47124?: Medium severity, with a CVSS score of 6.5, published 12 June 2026.
Which products and versions are affected?: github.com/nezhahq/nezha (Go) >= 1.4.0, < 1.14.15-0.20260517034128-05e5da253519, SEMVER:introduced=1.4.0,fixed=1.14.15-0.20260517034128-05e5da253519; NezhaHQ Nezha Monitoring >= 1.4.0, < 1.14.15-0.20260517034128-05e5da253519, >= 1.4.0, < 2.0.9.
Is there a fix for CVE-2026-47124?: Yes. github.com/nezhahq/nezha (Go): upgrade to 1.14.15-0.20260517034128-05e5da253519 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47124 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47124?: Check whether you run github.com/nezhahq/nezha (Go) or NezhaHQ Nezha Monitoring at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/nezhahq/nezha (Go): upgrade to 1.14.15-0.20260517034128-05e5da253519 or later
```
go get github.com/nezhahq/nezha@v1.14.15-0.20260517034128-05e5da253519
```

Technical details

An information disclosure vulnerability exists in Nezha Monitoring versions 1.4.0 through 2.0.8 due to improper authorization checks in the WebSocket server-status stream. While the standard REST API correctly implements object-level permissions via the 'HasPermission' check, the WebSocket endpoint at '/ws/server' treats any authenticated user as authorized to receive the full, unfiltered server list. An attacker with low-privileged account access can connect to this WebSocket to receive real-time telemetry—including CPU/GPU details, IP/host information, resource usage, and platform versions—for all servers across the entire instance, bypassing tenant isolation. The issue is fixed in version 2.0.9 by applying proper ownership filters to the WebSocket data stream.

Affected products

NezhaHQ Nezha Monitoring >= 1.4.0, < 2.0.9

Identifiers

CVE-2026-47124
GHSA-hvv7-hfrh-7gxj
GO-2026-5439

Timeline

2026-05-17: advisory: Original GitHub security advisory published
2026-06-12: disclosed: CVE published to NVD
2026-06-12: patched: Vulnerability addressed in version 2.0.9

References

https://github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxj

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.