CVE-2026-47268 Overview
CVE-2026-47268 is a Server-Side Request Forgery (SSRF) vulnerability in Nezha Monitoring, a self-hosted server and website monitoring tool. The flaw affects versions from 0.20.0 up to but not including 2.0.10. An authenticated dashboard user can create or update a DDNS profile with a provider webhook and configure an arbitrary webhook_url, HTTP method, request body, and headers. When DDNS triggers for a server using that profile, the dashboard issues the request through utils.HttpClient without the SSRF protections applied to notification webhooks. The vulnerability is tracked under [CWE-918] Server-Side Request Forgery.
Critical Impact
A low-privileged authenticated user can force the dashboard host to issue HTTP requests to loopback or internal network services, enabling blind SSRF and internal state-changing operations.
Affected Products
- Nezha Monitoring version 0.20.0 and later
- Nezha Monitoring versions prior to 2.0.10
- Self-hosted Nezha dashboard deployments exposing DDNS provider webhook configuration
Discovery Timeline
- 2026-06-12 - CVE-2026-47268 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47268
Vulnerability Analysis
Nezha Monitoring exposes a DDNS profile configuration that allows users to define a custom provider webhook. The profile accepts a fully user-controlled webhook_url, HTTP method, request body, and arbitrary headers. When a server bound to the profile triggers a DDNS update, the dashboard process dispatches the configured HTTP request server-side. The request is sent using utils.HttpClient, which lacks the host and address filtering applied to standard notification webhook code paths.
The response body is not returned to the requesting user along the confirmed code path. This restricts data exfiltration but still enables a blind SSRF primitive. An attacker can target loopback interfaces, link-local metadata endpoints, or internal services reachable from the dashboard host.
Root Cause
The root cause is inconsistent enforcement of SSRF protections across HTTP client usages. The notification webhook path validates destination addresses, but the DDNS provider webhook path invokes utils.HttpClient directly without equivalent guards. This bypass allows internal addresses to be reached from a low-privileged authenticated context that controls an owned server or DDNS profile.
Attack Vector
An authenticated user with permission to manage a server and its DDNS profile sets the provider webhook fields to point at an internal target such as http://127.0.0.1:<port>/ or a private RFC1918 address. The attacker then induces a DDNS event for a server bound to that profile. The dashboard process issues the configured request, including attacker-supplied method, headers, and body, against the internal endpoint. This enables interaction with administrative interfaces, cloud metadata services, or unauthenticated internal APIs co-located with the dashboard host.
No verified proof-of-concept code is published. See the GitHub Security Advisory for vendor technical details.
Detection Methods for CVE-2026-47268
Indicators of Compromise
- Outbound HTTP requests from the Nezha dashboard process targeting loopback (127.0.0.0/8), link-local (169.254.0.0/16), or RFC1918 ranges
- DDNS profile records with webhook_url values referencing internal hostnames, private IPs, or metadata endpoints such as 169.254.169.254
- Unexpected HTTP methods (PUT, DELETE, POST) originating from the dashboard process toward internal services
Detection Strategies
- Audit the Nezha database for DDNS profiles with non-public webhook_url targets and review the configured method, headers, and body
- Inspect dashboard egress logs for HTTP traffic to private address space that correlates with DDNS trigger events
- Alert on access attempts to cloud instance metadata services originating from the host running the Nezha dashboard
Monitoring Recommendations
- Enable verbose HTTP client logging in Nezha and forward logs to a centralized SIEM for correlation
- Monitor authenticated user activity that creates or updates DDNS profiles, especially from low-privileged accounts
- Apply egress firewall rules and log denied connections from the dashboard host to internal subnets
How to Mitigate CVE-2026-47268
Immediate Actions Required
- Upgrade Nezha Monitoring to version 2.0.10 or later, which contains the SSRF fix
- Review all existing DDNS profiles and remove or correct any webhook_url values pointing at internal addresses
- Restrict dashboard user registration and DDNS profile creation to trusted administrators until patched
Patch Information
The issue is patched in Nezha Monitoring version 2.0.10. The fix aligns the DDNS provider webhook code path with the SSRF protections already enforced on notification webhooks. Refer to the GitHub Security Advisory GHSA-6x26-5727-rrm9 for release details.
Workarounds
- Block outbound traffic from the dashboard host to loopback, link-local, and RFC1918 ranges using host or network firewall rules
- Run the Nezha dashboard in an isolated network segment with no route to sensitive internal services or cloud metadata endpoints
- Disable DDNS functionality or remove provider webhook profiles until the upgrade is applied
# Example egress restriction using iptables on the dashboard host
iptables -A OUTPUT -m owner --uid-owner nezha -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nezha -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nezha -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nezha -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner nezha -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
