Skip to content
Threat Feed

Tag

Nezha

2 briefs RSS
critical advisory

Nezha Monitoring Cross-Tenant RCE via Cron Task Injection

A RoleMember in Nezha monitoring dashboard can achieve cross-tenant remote code execution by injecting arbitrary commands into cron tasks due to insufficient authorization checks, impacting all monitored hosts in the deployment.

nezha rce privilege-escalation cron authorization
3r 3t
medium advisory

Nezha Monitoring RoleMember SSRF with Full Response Body Reflection

Nezha Monitoring is vulnerable to a server-side request forgery (SSRF) vulnerability, where a low-privilege RoleMember user can call notification routes and send HTTP requests to a user-controlled URL, with the entire response body reflected back to the caller, potentially exposing intranet resources and causing denial of service.

Nezha Monitoring ssrf nezha vulnerability
2r 3t