CVE-2026-47120: Nezha Monitoring Privilege Escalation

CVE-2026-47120 Overview

CVE-2026-47120 is a missing authorization vulnerability [CWE-862] in Nezha Monitoring, a self-hostable server and website monitoring tool. The flaw affects versions from 1.4.0 to before 2.0.8. A user with the RoleMember role can trigger cron tasks owned by other users through the AlertRule.FailTriggerTasks code path because the application does not perform an ownership check. The maintainers patched the issue in version 2.0.8.

Critical Impact
An authenticated low-privileged RoleMember can execute arbitrary cron tasks belonging to other users, leading to unauthorized command execution under another user's context and disruption of monitored systems.

Affected Products

Nezha Monitoring versions 1.4.0 through 2.0.7
Self-hosted Nezha dashboard deployments exposing the API to authenticated members
Multi-tenant Nezha installations with RoleMember accounts

Discovery Timeline

2026-06-12 - CVE-2026-47120 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47120

Vulnerability Analysis

Nezha Monitoring exposes an alerting subsystem that can fire cron tasks when alert rules trip. The AlertRule.FailTriggerTasks handler accepts a list of task identifiers to invoke when a failure condition is met. The handler does not verify that the calling user owns the referenced tasks. As a result, any authenticated user holding the RoleMember role can attach arbitrary task IDs to an alert rule and cause Nezha to execute those tasks server-side.

The consequence is a horizontal privilege escalation across tenant boundaries within the dashboard. Cron tasks in Nezha can run shell commands on monitored agents, so an attacker can leverage another user's task to issue commands they were never authorized to issue. The integrity impact is high, while confidentiality is unaffected because the bug does not directly expose stored data.

Root Cause

The root cause is a missing authorization check [CWE-862] in the alert rule handler. The code path responsible for binding fail-trigger tasks to an alert rule resolves task IDs without validating that each task belongs to the authenticated principal. Authorization is enforced at the alert rule object level but not propagated to referenced child resources.

Attack Vector

Exploitation requires network access to the Nezha dashboard API and a valid account with RoleMember privileges. The attacker enumerates or guesses cron task IDs belonging to other users, submits an alert rule mutation that references those IDs in FailTriggerTasks, and triggers the alert condition. Nezha then executes the foreign tasks as if their owner had initiated them. User interaction is not required.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-rxf6-wjh4-jfj6 for maintainer details.

Detection Methods for CVE-2026-47120

Indicators of Compromise

Cron task execution events on Nezha agents that do not correlate with the owning user's session activity in the dashboard.
Alert rule create or update API calls from RoleMember accounts that reference task IDs outside the caller's owned-task set.
Unexpected command output or file modifications on monitored hosts originating from the Nezha agent process.

Detection Strategies

Audit Nezha application logs for AlertRule mutations and cross-reference referenced FailTriggerTasks IDs against the user_id of each task in the database.
Alert on any divergence between an alert rule's owner and the owner of its bound tasks.
Review historical alert firings to identify tasks that ran under one user but were invoked through another user's rule.

Monitoring Recommendations

Forward Nezha dashboard access logs and agent execution logs to a centralized SIEM or data lake for correlation.
Track API requests to alert rule endpoints by user role, payload contents, and referenced task identifiers.
Monitor outbound commands from Nezha agents and baseline expected cron activity per host.

How to Mitigate CVE-2026-47120

Immediate Actions Required

Upgrade all Nezha Monitoring deployments to version 2.0.8 or later without delay.
Review existing alert rules and remove any FailTriggerTasks bindings that reference tasks owned by a different user.
Rotate credentials and revoke sessions for RoleMember accounts if abuse is suspected.

Patch Information

The maintainers fixed the issue in Nezha Monitoring version 2.0.8 by adding an ownership check on each task referenced in AlertRule.FailTriggerTasks. See the GitHub Security Advisory GHSA-rxf6-wjh4-jfj6 for the patch reference and upgrade guidance.

Workarounds

Restrict dashboard access to trusted operators by removing or downgrading RoleMember accounts until the upgrade is applied.
Place the Nezha dashboard behind a VPN or IP allowlist to reduce the authenticated attack surface.
Disable cron-task fail triggers on shared installations until version 2.0.8 is deployed.

bash

# Configuration example: upgrade Nezha to the patched release
docker pull ghcr.io/naiba/nezha-dashboard:v2.0.8
docker stop nezha-dashboard && docker rm nezha-dashboard
docker run -d --name nezha-dashboard \
  -p 8008:80 \
  -v /opt/nezha/dashboard/data:/dashboard/data \
  ghcr.io/naiba/nezha-dashboard:v2.0.8