Executive brief
Nezha Monitoring is a self-hosted tool used for monitoring the health and performance of servers and websites. A security flaw allows a user with valid agent credentials to submit fake monitoring data for services they do not own. This could lead to inaccurate status reports, false alerts, and the corruption of historical monitoring data, potentially causing operational confusion or masking actual service outages.
Technical details
A missing authorization check in the service-monitor result worker (specifically within `service/singleton/servicesentinel.go`) allows authenticated agents to submit `TaskResult` messages for any service ID. While the dashboard correctly restricts outbound task dispatch based on server ownership and service coverage, the inbound gRPC stream processing only verifies that the reported service ID exists. It fails to validate that the reporting agent was actually assigned the task or that the agent's owner has permission to monitor that specific service. An attacker with a valid agent secret can exploit this to inject arbitrary monitoring data, including 'successful' or 'failed' states and custom result text, into the history and current status of victim-owned services. This vulnerability was patched in version 2.0.12.
Affected products
- NezhaHQ Nezha Monitoring 0.20.0 to 2.0.11
Timeline
- 2026-05-21: advisory: Original GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD
- 2026-06-12: patched: Patch confirmed in version 2.0.12