Nezha Monitoring EUVD-2026-36598

No special conditions - remote unauthenticated exploitation against default configurations of the Nezha Monitoring dashboard, reachable on whatever port/host the operator exposes (typically the dashboard HTTP listener). The only limiting factors are network reachability of the /dashboard route and that the targeted instance runs a version earlier than 2.0.13; no user interaction, no prior credentials, and no non-default settings are required, because the vulnerable fallbackToFrontend handler is part of the standard NoRoute pipeline.

The signals are mostly aligned toward high real-world risk: the published CVSS3.1 vector AV:N/AC:L/PR:N/UI:N marks the bug as remotely exploitable, unauthenticated, and low-complexity, and the description confirms no authentication is required and provides a working payload. However, the input vector lists I:H, which is questionable: http.ServeFile only reads files, so direct integrity impact is N - the realistic integrity/availability damage is secondary, by exfiltrating data/config.yaml (which on Nezha typically holds DB credentials, OAuth secrets, and the admin agent secret) and then pivoting. No EPSS, KEV, or POC indicators were supplied; absence is not confirmation, but at the time of analysis there is no evidence of in-the-wild exploitation. Net assessment: prioritize patching because exposed Nezha dashboards are commonly internet-facing and the config-file disclosure path is a one-request compromise of every downstream secret.

An attacker scans the internet for Nezha dashboards on common ports (8008, 80, 443) and issues a single unauthenticated GET request such as GET /dashboard../data/config.yaml HTTP/1.1, receiving the raw YAML containing the admin and agent secrets and database credentials. With those secrets the attacker then authenticates to the dashboard, registers as a controller of every monitored host, and uses Nezha's task-execution feature to run commands across the fleet. The exploitation primitive is described in full in the advisory, so trivially weaponizable proof-of-concept code is expected even though none was supplied in this dataset.