Nezha Dashboard Access Control and Disclosure Flaws

Cleartext third-party credentials are exposed to any authenticated principal holding DDNS read access in Nezha versions 2.2.5 through 2.3.14, because the GET /api/v1/ddns list handler returns DDNS webhook profiles without redacting the WebhookURL and WebhookRequestBody fields. An admin account or a Personal Access Token granted the nezha:ddns:read scope can retrieve tokens embedded directly in other users' webhook URLs (for example query strings such as ?token=...) or request bodies, which the vendor's fix specifically addresses for every user's profiles rather than only the requester's. Per the vendor-assigned CVSS 4.0 vector (7.1, PR:L, VC:H with no integrity or availability impact), the exposure is confidentiality-only and gated behind the authentication and scope prerequisite; no public exploit identified at time of analysis, and neither CISA KEV status nor public exploit code is reported for this issue.

Nezha monitoring dashboards running versions 1.0.0 through 2.3.14 can be knocked offline by an authenticated user who holds file-manager scope, because the dashboard's file manager WebSocket handler (fmStream) never imposes a read limit on incoming frames. A single oversized binary message sent to /api/v1/ws/file/:id is buffered whole by gorilla/websocket, exhausting process memory until the kernel OOM-killer terminates the dashboard - which in turn severs monitoring visibility for every agent the dashboard managed. There is no public exploit identified at time of analysis, but a vendor patch (2.3.15) and the upstream fixing commit are already public, so any dashboard exposed to users with file-manager permissions should be treated as a moderate-priority availability risk rather than a critical one; the attacked service is the dashboard itself, not the monitored endpoints.

Resource exhaustion in Nezha 2.0.13 through 2.3.14 allows an authenticated user to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint and hold thousands of ServerTransferClass.Subscribe subscriptions without limit, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections. Exploitation requires a valid authenticated dashboard session (CVSS vector includes PR:L), with no user interaction and no non-default configuration beyond a login-capable account; the impact is limited to availability of the dashboard and agent connectivity, and no public exploit has been identified at time of analysis. A vendor patch is available in Nezha 2.3.15 and later.

Host header injection in Nezha 2.1.0 through 2.3.14 lets an attacker who can control or spoof the Host header on a victim's MCP request redirect file uploads and capture one-time download tokens that can be replayed to exfiltrate files. The flaw is in mintTransferTool, which builds the fs.download_url and fs.upload_url transfer links from the unvalidated Host header, so the observable impact is limited to low confidentiality and integrity loss rather than code execution. Exploitation is unauthenticated per the CVSS vector (PR:N) but conditional on the attacker influencing the reflected Host value - for example through a misconfigured or trusting reverse proxy, DNS rebinding, or a man-in-the-middle position on the victim's path - and on the victim actually invoking the MCP transfer tools. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped a fix in Nezha 2.3.15.

Cross-tenant server ID enumeration in the Nezha monitoring dashboard (versions 1.7.0 through 2.3.14) lets an authenticated low-privilege member map other tenants' server IDs by sweeping sequential identifiers against the getServerConfig and setServerConfig endpoints and distinguishing 'permission denied' responses from success payloads. According to the authoritative assessment, exploitation requires a valid member account plus a shared, multi-tenant deployment where more than one user's servers coexist; on a single-tenant self-hosted install there are no other tenants to enumerate, sharply reducing real impact. It yields server-ID mapping rather than configuration contents, secrets, or control, and stays confined to a low-severity information-disclosure outcome (C:L, I:N, A:N). No public exploit code was identified at time of analysis, and this CVE is not in CISA KEV; vendor patch version 2.3.15 is available.