CVE-2026-49396: Nezha Monitoring CSRF Vulnerability

CVE-2026-49396 Overview

CVE-2026-49396 is a Cross-Site Request Forgery (CSRF) vulnerability in Nezha Monitoring, a self-hostable server and website monitoring and operations tool. The flaw affects versions from 1.0.0 up to but not including 2.0.14. An attacker can craft a malicious page that issues a cross-site GET request to a victim's authenticated Nezha dashboard. The request triggers stored cron commands on the victim's monitoring agents, enabling unauthorized command execution on monitored servers. The maintainers patched the issue in version 2.0.14.

Critical Impact
A cross-site GET request can execute stored cron commands on the victim's connected Nezha agents, leading to integrity loss across monitored infrastructure.

Affected Products

Nezha Monitoring versions 1.0.0 through 2.0.13
Nezha agents managed by vulnerable Nezha dashboards
Self-hosted Nezha deployments accessible via authenticated browser sessions

Discovery Timeline

2026-06-12 - CVE-2026-49396 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49396

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery flaw classified under [CWE-352]. Nezha Monitoring exposes endpoints that accept GET requests to trigger stored cron commands without verifying the request origin. An authenticated administrator visiting an attacker-controlled page causes the browser to send the request with valid session cookies attached. The dashboard processes the request as legitimate and dispatches the configured cron command to the agents.

Because Nezha agents execute commands on the host systems they monitor, the impact extends beyond the dashboard itself. Any server connected to the dashboard as a monitored agent becomes a target for arbitrary stored command execution. The attack succeeds without the victim's knowledge once the malicious page loads.

Root Cause

The root cause is the absence of anti-CSRF protections on state-changing endpoints that trigger cron command execution. State-changing actions accepted via GET requests compound the issue, since GET requests can be initiated through <img>, <script>, or <iframe> tags without user interaction beyond visiting a page. The application relies on session cookies alone for authorization and does not validate request origin, referrer, or a CSRF token.

Attack Vector

Exploitation requires an authenticated Nezha administrator to visit an attacker-controlled webpage while logged into the dashboard. The attacker hosts HTML that issues a cross-origin GET request to the victim's Nezha instance. The browser automatically attaches the session cookie, and the dashboard executes the stored cron command on the targeted agents. User interaction is limited to visiting the malicious page, as reflected in the CVSS UI:R metric. No prior privileges on the target dashboard are required from the attacker.

No public proof-of-concept exploit is currently listed for this CVE. Technical detail is available in the GitHub Security Advisory GHSA-8qhj-4f8c-j8qg.

Detection Methods for CVE-2026-49396

Indicators of Compromise

Unexpected execution of stored cron commands on Nezha agents outside of scheduled windows
Dashboard access logs showing state-changing GET requests with external Referer headers
Agent process trees showing commands launched by the Nezha agent service without a corresponding administrator action
New or modified stored cron command entries that administrators do not recognize

Detection Strategies

Review Nezha dashboard HTTP access logs for cron-trigger endpoints invoked via GET with cross-origin referrers
Correlate dashboard request timestamps with agent command execution events to identify mismatches
Alert on Nezha agent child processes that deviate from approved baseline command sets
Monitor browser sessions of administrators for navigation to untrusted domains while authenticated to the dashboard

Monitoring Recommendations

Enable verbose access logging on the Nezha web server and forward logs to a centralized analytics platform
Track the Nezha version string in inventory tooling to flag instances below 2.0.14
Monitor egress from administrator workstations for connections to suspicious domains while dashboard sessions are active
Audit stored cron command definitions on a recurring schedule to detect unauthorized changes

How to Mitigate CVE-2026-49396

Immediate Actions Required

Upgrade all Nezha Monitoring dashboard installations to version 2.0.14 or later
Audit stored cron commands on every agent and remove entries that are not authorized
Force re-authentication of all dashboard sessions after upgrading to invalidate any active cookies
Restrict dashboard access to trusted networks using firewall rules or a reverse proxy with IP allow-listing

Patch Information

The maintainers fixed CVE-2026-49396 in Nezha Monitoring version 2.0.14. Operators running any release in the 1.0.0 through 2.0.13 range must upgrade. Patch notes and the security advisory are published at the Nezha GHSA-8qhj-4f8c-j8qg advisory.

Workarounds

Place the Nezha dashboard behind an authenticating reverse proxy that enforces strict Referer and Origin header checks
Require administrators to use a dedicated browser profile when accessing the dashboard to reduce CSRF exposure
Log out of the Nezha dashboard immediately after administrative tasks to limit the session window
Remove or disable stored cron commands that are not strictly required until the upgrade is applied

bash

# Configuration example: upgrade Nezha dashboard via Docker
docker pull ghcr.io/nezhahq/nezha:v2.0.14
docker stop nezha-dashboard
docker rm nezha-dashboard
docker run -d --name nezha-dashboard \
  -p 8008:80 \
  -v /opt/nezha/data:/dashboard/data \
  ghcr.io/nezhahq/nezha:v2.0.14