Executive brief
Nezha Monitoring is a tool used by administrators to track the health and performance of servers and websites. A security flaw allows any registered user to view detailed technical data and live performance metrics for all servers on the system, including those belonging to other users or organizations. This could allow an unauthorized person to see sensitive infrastructure details, usage patterns, and the operational status of servers they should not have access to.
Technical details
An information disclosure vulnerability exists in Nezha Monitoring versions 1.4.0 through 2.0.8 due to improper authorization checks in the WebSocket server-status stream. While the standard REST API correctly implements object-level permissions via the 'HasPermission' check, the WebSocket endpoint at '/ws/server' treats any authenticated user as authorized to receive the full, unfiltered server list. An attacker with low-privileged account access can connect to this WebSocket to receive real-time telemetry—including CPU/GPU details, IP/host information, resource usage, and platform versions—for all servers across the entire instance, bypassing tenant isolation. The issue is fixed in version 2.0.9 by applying proper ownership filters to the WebSocket data stream.
Affected products
- NezhaHQ Nezha Monitoring >= 1.4.0, < 2.0.9
Timeline
- 2026-05-17: advisory: Original GitHub security advisory published
- 2026-06-12: disclosed: CVE published to NVD
- 2026-06-12: patched: Vulnerability addressed in version 2.0.9