# CVE-2026-47124: Nezha Monitoring Information Disclosure in Server-Status WebSocket

Source: https://junglewise.ai/threats/cve-2026-47124-nezha-monitoring-information-disclosure-in-server-status  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-47124 · Severity: medium · CVSS 6.5 · Published 2026-06-12

Nezha Monitoring is a tool used by administrators to track the health and performance of servers and websites. A security flaw allows any registered user to view detailed technical data and live performance metrics for all servers on the system, including those belonging to other users or organizations. This could allow an unauthorized person to see sensitive infrastructure details, usage patterns, and the operational status of servers they should not have access to.

Technologies: [github.com/nezhahq/nezha (Go)](https://junglewise.ai/threats/technologies/github-com-nezhahq-nezha), [NezhaHQ Nezha Monitoring](https://junglewise.ai/threats/technologies/nezha). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [NezhaHQ](https://junglewise.ai/threats/vendors/nezhahq).

## Quick answers

**Is CVE-2026-47124 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47124 being exploited in the wild.

**How severe is CVE-2026-47124?** Medium severity, with a CVSS score of 6.5, published 12 June 2026.

**Which products and versions are affected?** github.com/nezhahq/nezha (Go) >= 1.4.0, < 1.14.15-0.20260517034128-05e5da253519, SEMVER:introduced=1.4.0,fixed=1.14.15-0.20260517034128-05e5da253519; NezhaHQ Nezha Monitoring >= 1.4.0, < 1.14.15-0.20260517034128-05e5da253519, >= 1.4.0, < 2.0.9.

**Is there a fix for CVE-2026-47124?** Yes. github.com/nezhahq/nezha (Go): upgrade to 1.14.15-0.20260517034128-05e5da253519 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47124 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47124?** Check whether you run github.com/nezhahq/nezha (Go) or NezhaHQ Nezha Monitoring at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/nezhahq/nezha (Go): upgrade to 1.14.15-0.20260517034128-05e5da253519 or later

  ```sh
  go get github.com/nezhahq/nezha@v1.14.15-0.20260517034128-05e5da253519
  ```


## Technical details

An information disclosure vulnerability exists in Nezha Monitoring versions 1.4.0 through 2.0.8 due to improper authorization checks in the WebSocket server-status stream. While the standard REST API correctly implements object-level permissions via the 'HasPermission' check, the WebSocket endpoint at '/ws/server' treats any authenticated user as authorized to receive the full, unfiltered server list. An attacker with low-privileged account access can connect to this WebSocket to receive real-time telemetry—including CPU/GPU details, IP/host information, resource usage, and platform versions—for all servers across the entire instance, bypassing tenant isolation. The issue is fixed in version 2.0.9 by applying proper ownership filters to the WebSocket data stream.

## Affected products

- NezhaHQ Nezha Monitoring >= 1.4.0, < 2.0.9

## Identifiers

- CVE-2026-47124
- GHSA-hvv7-hfrh-7gxj
- GO-2026-5439

## Timeline

- 2026-05-17: advisory: Original GitHub security advisory published
- 2026-06-12: disclosed: CVE published to NVD
- 2026-06-12: patched: Vulnerability addressed in version 2.0.9

## References

- [https://github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxj](https://github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxj)

## Related threats

- [Nezha monitoring dashboard denial of service via service deletion race](https://junglewise.ai/threats/cve-2026-100394-nezha-monitoring-whole-instance-dos-in-nezha-dashboard-a-member)
- [Nezha Host header injection in OAuth2 redirect endpoint](https://junglewise.ai/threats/cve-2026-101090-nezha-2-2-3-contains-a-host-header-injection-regression-in-the)
- [Nezha OAuth2 redirect_uri Host header injection regression](https://junglewise.ai/threats/nezha-oauth2-redirect-uri-host-header-injection-regression-331e924a)
- [Nezha Monitoring insufficient stream authorization in websocket endpoints](https://junglewise.ai/threats/cve-2026-62283-nezha-monitoring-insufficient-stream-authorization-in-websocket)
- [Nezha Monitoring plaintext credential exposure in DDNS and Notification APIs](https://junglewise.ai/threats/cve-2026-59155-nezha-monitoring-plaintext-credential-exposure-in-ddns-and)