CVE-2026-47124: Nezha Monitoring Info Disclosure Flaw

CVE-2026-47124 Overview

CVE-2026-47124 is an information disclosure vulnerability in Nezha Monitoring, a self-hostable server and website monitoring tool. The flaw affects versions 1.4.0 through 2.0.8. Any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The standard server list API correctly filters objects through HasPermission, but the WebSocket stream treats the presence of any authenticated user as authorization for the full unfiltered server list. The issue is tracked under [CWE-200] and has been patched in version 2.0.9.

Critical Impact
Authenticated low-privilege users can harvest telemetry data for every server registered in a Nezha instance, breaking tenant isolation in multi-user deployments.

Affected Products

Nezha Monitoring versions 1.4.0 through 2.0.8
Self-hosted Nezha dashboard instances with multi-user accounts
Multi-tenant monitoring deployments using shared Nezha servers

Discovery Timeline

2026-06-12 - CVE-2026-47124 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47124

Vulnerability Analysis

Nezha Monitoring exposes a real-time telemetry stream through a WebSocket endpoint named server-status. This endpoint pushes server metrics such as CPU, memory, network, and host metadata to subscribed clients. In a properly isolated deployment, each authenticated user should only see telemetry for servers they own or have been granted access to.

The REST endpoint that returns the server list enforces this rule by applying the HasPermission filter on each server object. The WebSocket handler does not. Once a session is authenticated, the stream emits the complete, unfiltered server list to that connection. Any registered non-admin account becomes a viable vantage point for cross-tenant reconnaissance.

Root Cause

The root cause is a Broken Access Control flaw in the authorization model of the WebSocket handler. Authentication and authorization are conflated. The handler verifies that the caller is logged in and then assumes that authentication implies entitlement to every server object. The per-object HasPermission check applied in the REST path is not mirrored in the streaming path, producing inconsistent enforcement between transports.

Attack Vector

An attacker needs a valid low-privilege account on the target Nezha instance. The attacker authenticates normally, opens a WebSocket connection to the server-status endpoint, and reads the streamed payloads. The returned telemetry includes hostnames, IP addresses, operating system details, and live resource metrics for every monitored server across all tenants. No interaction with other users is required, and no elevated privileges are needed.

The vulnerability is described in the GitHub Security Advisory GHSA-hvv7-hfrh-7gxj. No public proof-of-concept exploit code is referenced in the advisory.

Detection Methods for CVE-2026-47124

Indicators of Compromise

WebSocket connections to the server-status endpoint originating from non-admin user sessions
Unexpected long-lived WebSocket sessions from user accounts that do not own any monitored servers
Access log entries showing authenticated upgrades to WebSocket from accounts with minimal permissions

Detection Strategies

Correlate authenticated user roles with WebSocket subscriptions and flag non-admin accounts subscribing to server-status
Review Nezha application logs for users receiving telemetry for servers they do not own
Inspect reverse proxy access logs for HTTP 101 upgrade responses tied to low-privilege session cookies

Monitoring Recommendations

Forward Nezha access and WebSocket logs to a centralized logging platform for retention and analysis
Alert on new non-admin accounts that immediately initiate server-status WebSocket connections after login
Track the count of server objects emitted per session and alert when a non-admin session receives more objects than the user owns

How to Mitigate CVE-2026-47124

Immediate Actions Required

Upgrade all Nezha Monitoring deployments to version 2.0.9 or later
Audit existing user accounts and remove non-admin accounts that are no longer required
Rotate session tokens and API keys after upgrading to invalidate any sessions established before the patch
Review recent access logs for unauthorized WebSocket consumption of server-status

Patch Information

The maintainers patched the issue in Nezha Monitoring version 2.0.9. The fix applies the HasPermission filter to the WebSocket stream so that each authenticated user receives only the server objects they are entitled to view. Refer to the GitHub Security Advisory GHSA-hvv7-hfrh-7gxj for release details.

Workarounds

Restrict registration so that only trusted operators hold accounts on the Nezha dashboard until the upgrade is applied
Place the dashboard behind a reverse proxy and block WebSocket upgrades to server-status for non-admin user groups
Segment multi-tenant deployments into separate Nezha instances per tenant to remove cross-tenant exposure

bash

# Example nginx rule to block server-status WebSocket while patching
location /api/v1/ws/server {
    # Temporarily restrict to admin source IPs only
    allow 203.0.113.0/24;
    deny all;
    proxy_pass http://nezha_backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}