CVE-2026-46717

High

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler — so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8.

SeverityHigh

CVSS7.7

Exploit probability—

ProductGithub.com/nezhahq/nezha

PublishedJun 12, 2026

First seenJun 12, 2026

Weakness typeCWE-863Incorrect authorization CWE-918Server-side request forgery (SSRF)

How to fix

Update

github.com/nezhahq/nezha1.14.15-0.20260517022419-d06d539d34c1 or later

Affected products

Product	Affected versions	Fixed in
github.com/nezhahq/nezhaGo	1.4.0 ≤ v < 1.14.15-0.20260517022419-d06d539d34c1	1.14.15-0.20260517022419-d06d539d34c1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.