CVE-2026-48119: Nezha Monitoring Auth Bypass Vulnerability

CVE-2026-48119 Overview

CVE-2026-48119 affects Nezha Monitoring, a self-hostable, lightweight server and website monitoring and operations and maintenance (O&M) tool. The vulnerability allows authenticated agents to forge service-monitor results for services belonging to other users. It impacts versions from 0.20.0 up to but not including 2.0.12. The maintainers patched the issue in version 2.0.12. The flaw maps to CWE-862: Missing Authorization and stems from the server not validating whether a reporting agent is authorized to submit results for a given service.

Critical Impact
Authenticated agents can submit forged monitoring results against services owned by other tenants, undermining the integrity of monitoring data and triggering false operational decisions.

Affected Products

Nezha Monitoring versions 0.20.0 through 2.0.11
Self-hosted Nezha dashboard deployments
Nezha agents communicating with vulnerable dashboard versions

Discovery Timeline

2026-06-12 - CVE-2026-48119 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48119

Vulnerability Analysis

The vulnerability is a missing authorization flaw in the Nezha Monitoring server-side handling of service-monitor reports. Authenticated agents submit health and availability results for services they are supposed to monitor. The server fails to verify that the submitting agent is actually assigned to the target service. As a result, any authenticated agent can craft reports referencing services owned by other users.

The impact is concentrated on data integrity. Forged results can mark healthy services as down, mark failing services as healthy, or inject misleading latency and availability metrics. Downstream alerts, dashboards, and automated O&M actions consume this falsified data. The vulnerability requires network access to the dashboard and valid agent credentials, but it does not require user interaction.

Root Cause

The root cause is an authorization check missing on the service-monitor result ingestion path. The server trusts the service identifier supplied by the agent without confirming ownership or assignment. This is the pattern described by CWE-862, where a critical action lacks an authorization check.

Attack Vector

An attacker first obtains valid agent credentials on a multi-tenant or shared Nezha deployment. The attacker then submits crafted service-monitor reports referencing service IDs owned by other users. Because the server does not validate ownership, the reports are accepted and persisted. The attacker can repeat this to manipulate monitoring history, suppress real outage alerts, or fabricate outages for targeted services. See the Nezha GitHub Security Advisory GHSA-4g6j-g789-rghm for the vendor description.

No public proof-of-concept is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.368%.

Detection Methods for CVE-2026-48119

Indicators of Compromise

Service-monitor reports arriving from agents not assigned to the referenced service ID.
Sudden state flips (up/down) on services without corresponding network or host telemetry from other sources.
Inconsistent latency or availability metrics submitted by agents whose source IP differs from the historical agent baseline.

Detection Strategies

Correlate agent-to-service assignments stored in the Nezha database with the agent IDs appearing on inbound monitor reports, and alert on mismatches.
Review dashboard audit logs for service-monitor result submissions and flag entries where the submitting agent is not part of the service's authorized agent list.
Compare Nezha availability data against an independent, out-of-band monitoring source to surface fabricated state transitions.

Monitoring Recommendations

Forward Nezha dashboard and agent logs to a centralized log platform and retain them for post-incident analysis.
Alert on bursts of service-monitor submissions from a single agent referencing many distinct service IDs.
Track newly registered agents and monitor their reporting behavior during the first 24-48 hours for anomalous service references.

How to Mitigate CVE-2026-48119

Immediate Actions Required

Upgrade all Nezha Monitoring dashboard instances to version 2.0.12 or later.
Rotate agent secrets and API tokens after upgrading to invalidate any credentials that may have been abused.
Audit historical monitor data for the affected version range and discard or annotate suspicious entries.

Patch Information

The maintainers fixed the missing authorization check in Nezha Monitoring version 2.0.12. Self-hosted operators should pull the updated release from the project repository and redeploy the dashboard. Refer to the GitHub Security Advisory GHSA-4g6j-g789-rghm for the official remediation notice.

Workarounds

Restrict dashboard network exposure so that only trusted agents can reach the service-monitor ingestion endpoint.
Limit agent account provisioning to a single trusted operator on multi-tenant deployments until the upgrade to 2.0.12 is complete.
Treat Nezha service-state data as advisory during the exposure window and corroborate critical alerts with an independent monitoring source.

bash

# Upgrade example for a containerized Nezha dashboard deployment
docker pull ghcr.io/nezhahq/nezha:v2.0.12
docker stop nezha-dashboard
docker rm nezha-dashboard
docker run -d --name nezha-dashboard \
  -p 8008:80 \
  -v /opt/nezha/data:/dashboard/data \
  ghcr.io/nezhahq/nezha:v2.0.12