EUVD-2026-36599
GHSA-x6fg-52vr-hj4w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Low-privilege authentication required (PR:L); network-accessible endpoint (AV:N); no complexity beyond holding valid credentials; impact is complete availability loss with no confidentiality or integrity component.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0.
AnalysisAI
Nezha Monitoring versions 2.0.14 through 2.1.0 (exclusive) allows any authenticated user to exploit the NAT-based Host claiming mechanism to preempt all dashboard routing, resulting in complete availability loss for the monitoring platform. The vulnerability stems from CWE-284 (Improper Access Control) - the application fails to properly restrict which authenticated principals may register or override a dashboard Host identity via NAT traversal. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Nezha Monitoring (CPE: cpe:2.3:a:nezhahq:nezha) is a self-hosted, lightweight server and website monitoring and operations management tool that supports NAT traversal for agent-to-dashboard communication. The NAT host claim mechanism - designed to allow agents behind NAT to register themselves with the dashboard - lacks sufficient access controls (CWE-284: Improper Access Control) to verify that an authenticated user is authorized to claim or override a specific dashboard Host entry. By manipulating this registration pathway, any low-privileged authenticated user can preempt the routing table for the entire dashboard, displacing legitimate agents and disrupting the monitoring service. The scope is limited to the dashboard's own routing, with no scope change to external systems.
RemediationAI
Upgrade Nezha Monitoring to version 2.1.0 or later, which contains the vendor-released patch for this issue. Details are available in the GitHub Security Advisory at https://github.com/nezhahq/nezha/security/advisories/GHSA-x6fg-52vr-hj4w. If an immediate upgrade is not possible, restrict dashboard account creation to trusted principals only, as the attack requires an authenticated session - reducing the pool of legitimate users limits exposure. Additionally, network-layer access controls (e.g., firewall rules, VPN gateway) that restrict who can reach the dashboard's NAT registration endpoint would reduce the effective attack surface, though this is a compensating control, not a fix. Neither workaround eliminates the underlying access control flaw.
Unauthenticated path traversal in Nezha Monitoring (nezhahq/nezha) before 2.0.13 allows remote attackers to read arbitra
Cross-tenant session hijacking in Nezha Monitoring (v1.14.13-1.14.14 and v2.0.0-2.0.9) lets any authenticated low-privil
Nezha Monitoring versions prior to 2.2.5 expose stored third-party API credentials in plaintext through two listing API
Host header injection in Nezha Monitoring versions 1.0.0 through 2.2.0 allows unauthenticated remote attackers to redire
Unbounded WebSocket stream allocation in Nezha Monitoring versions 1.0.0 through 2.1.x allows any authenticated dashboar
Incorrect authorization in Nezha Monitoring's DDNS profile subsystem allows an authenticated low-privilege member to pre
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today