CVE-2026-46716 Overview
CVE-2026-46716 is a command injection vulnerability in Nezha Monitoring, a self-hostable server and website monitoring and operations tool. The flaw affects versions from 1.4.0 up to but not including 2.0.8. A low-privileged RoleMember user can create a scheduled cron task with Cover=CronCoverAll and an empty Servers=[] list, causing the dashboard to dispatch an attacker-supplied command to every agent in the global ServerShared map. This bypasses tenant isolation and reaches servers owned by administrators and other members. The vulnerability is classified under [CWE-78] (OS Command Injection).
Critical Impact
An authenticated low-privileged tenant can execute arbitrary OS commands on every agent across all tenants and exfiltrate output through an attacker-controlled webhook.
Affected Products
- Nezha Monitoring versions 1.4.0 through 2.0.7
- Self-hosted Nezha dashboard deployments
- All Nezha agents registered in multi-tenant dashboards
Discovery Timeline
- 2026-06-12 - CVE-2026-46716 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-46716
Vulnerability Analysis
Nezha Monitoring exposes a scheduled task feature that lets users define cron jobs targeting selected agents. The dashboard enforces tenant scoping by filtering on the Servers list supplied with the task. When a task is created with Cover=CronCoverAll and an empty Servers=[], the scheduler interprets the empty list as a wildcard rather than as a deny-all set. At each scheduler tick the dashboard iterates the process-global ServerShared map and pushes the configured command to every connected agent, regardless of which tenant owns the agent. Each agent executes the command under the privileges of the Nezha agent process and returns stdout and stderr through the standard task result channel. The result is then forwarded to the originating user's NotificationGroup, which the attacker controls and can point at an external webhook to receive captured output.
Root Cause
The root cause is missing authorization on the cron task dispatch path. The code treats Cover=CronCoverAll with Servers=[] as authorization to address every agent, and it fails to constrain the iteration to servers owned by the requesting tenant. Tenant ownership is enforced at the UI selection layer but not at the dispatch layer, leaving the global ServerShared map directly addressable.
Attack Vector
An attacker authenticates as any RoleMember user and submits a cron task definition through the dashboard API. The task sets Cover to CronCoverAll, leaves Servers empty, and places an arbitrary shell command in the Command field. The attacker also defines a NotificationGroup pointing at a webhook they control. When the scheduler fires, every agent across all tenants executes the command and returns output to the attacker's webhook. No additional user interaction is required.
No public proof-of-concept code is published. See the GitHub Security Advisory GHSA-99gv-2m7h-3hh9 for the maintainer's technical description.
Detection Methods for CVE-2026-46716
Indicators of Compromise
- Cron task entries in the Nezha dashboard database with Cover set to CronCoverAll and an empty Servers array created by non-admin accounts
- Outbound HTTP/HTTPS connections from the dashboard host to unknown webhook domains tied to user-defined NotificationGroup entries
- Unexpected command executions on agent hosts originating from the Nezha agent process at scheduler-aligned intervals
- Agent logs showing identical commands running across servers that belong to different tenants
Detection Strategies
- Audit the Nezha cron task table for records with Cover=CronCoverAll, empty Servers, and a creator that is not an administrator
- Correlate process creation events on agent hosts with the parent Nezha agent binary and flag executions of shells, downloaders, or reconnaissance commands
- Monitor dashboard egress traffic for webhook URLs that do not match approved notification destinations
Monitoring Recommendations
- Enable verbose audit logging on the Nezha dashboard for task creation, modification, and dispatch events
- Forward dashboard and agent logs to a centralized SIEM or data lake and alert on cross-tenant command patterns
- Baseline normal cron task volume per user role and alert on RoleMember accounts creating dashboard-wide tasks
How to Mitigate CVE-2026-46716
Immediate Actions Required
- Upgrade every Nezha Monitoring dashboard to version 2.0.8 or later without delay
- Review existing cron tasks and delete any entries with Cover=CronCoverAll and empty Servers lists created by non-admin users
- Rotate credentials, API tokens, and secrets that were accessible from any Nezha-managed host during the exposure window
- Inspect agent hosts for unauthorized binaries, persistence artifacts, and outbound connections to unknown webhooks
Patch Information
The maintainers patched the issue in Nezha Monitoring version 2.0.8. Details and patch references are published in the Nezha GitHub Security Advisory GHSA-99gv-2m7h-3hh9. Operators running any release between 1.4.0 and 2.0.7 must upgrade to remediate the vulnerability.
Workarounds
- Restrict dashboard accounts to trusted administrators until the upgrade to 2.0.8 is complete
- Disable user self-registration and remove unnecessary RoleMember accounts from the dashboard
- Apply network egress restrictions on the dashboard host to allow only approved notification webhook destinations
- Place the dashboard behind authenticated reverse-proxy access controls to limit exposure of the task creation API
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
