CVE-2026-49397 Overview
CVE-2026-49397 is an information disclosure vulnerability in Nezha Monitoring, a self-hostable server and website monitoring and operations tool. The flaw affects versions 2.0.0 through 2.0.13 and allows unauthenticated remote attackers to enumerate private services configured with EnableShowInService: false. Per-server endpoints leak service names and timing data that administrators expect to remain hidden. The maintainers patched the issue in version 2.0.14. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Remote, unauthenticated attackers can enumerate private monitored services and read their names and timing metadata through per-server API endpoints, defeating the privacy setting intended to hide them.
Affected Products
- Nezha Monitoring versions 2.0.0 through 2.0.13
- Self-hosted Nezha deployments exposing the dashboard to untrusted networks
- Any Nezha instance using EnableShowInService: false to mark services private
Discovery Timeline
- 2026-06-12 - CVE-2026-49397 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2026-49397
Vulnerability Analysis
Nezha Monitoring exposes service status data through per-server endpoints that the dashboard consumes to render service health views. The configuration flag EnableShowInService: false is intended to keep a service hidden from public service listings. The vulnerability stems from an authorization gap: per-server endpoints do not honor this visibility flag when returning service data. Unauthenticated callers can iterate server identifiers and retrieve metadata for services that should be hidden. The leaked content includes service names and timing data, providing reconnaissance value to attackers mapping internal infrastructure.
Root Cause
The EnableShowInService flag is enforced inconsistently across endpoints. The aggregate service listing applies the filter, but the per-server endpoints return raw service records without checking the visibility property. This represents a missing authorization check rather than a memory or input-handling defect, mapping cleanly to [CWE-200].
Attack Vector
An attacker reaches the Nezha HTTP interface over the network without credentials or user interaction. The attacker enumerates server identifiers and issues requests to the per-server endpoints. The response contains private service entries with names and timing fields. No exploitation code has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score at publication is approximately 0.34 percent.
No verified exploit code is available. Refer to the GitHub Security Advisory GHSA-vrmh-5mmx-hjwx for maintainer-published technical details.
Detection Methods for CVE-2026-49397
Indicators of Compromise
- Unauthenticated HTTP GET requests to per-server Nezha endpoints from external or unexpected source addresses
- Bursts of sequential requests iterating server identifiers, indicating enumeration behavior
- Response payloads containing service names that match entries marked EnableShowInService: false in the Nezha configuration
Detection Strategies
- Inspect Nezha access logs for requests to per-server service endpoints that lack authenticated session cookies or tokens
- Compare names returned by per-server endpoints against the configured private service list to detect leakage
- Alert on access patterns that iterate server IDs in sequence within a short time window
Monitoring Recommendations
- Forward Nezha web server and reverse proxy logs to a centralized log platform for retention and search
- Track the version of every deployed Nezha instance and flag any still running below 2.0.14
- Monitor outbound exposure of the Nezha dashboard and restrict it to authenticated administrative networks
How to Mitigate CVE-2026-49397
Immediate Actions Required
- Upgrade all Nezha Monitoring deployments to version 2.0.14 or later, which contains the official fix
- Place the Nezha dashboard behind an authenticating reverse proxy or VPN until the upgrade is complete
- Audit the list of services marked EnableShowInService: false and review whether names or timing data exposed since 2.0.0 require rotation or renaming
Patch Information
The maintainers fixed CVE-2026-49397 in Nezha Monitoring version 2.0.14. Upgrade guidance and the patch description are available in the GitHub Security Advisory GHSA-vrmh-5mmx-hjwx.
Workarounds
- Restrict network access to the Nezha HTTP interface using firewall rules or an authenticated reverse proxy
- Remove private services from monitored servers if they cannot be upgraded in the short term
- Rename sensitive services to non-identifying labels to reduce reconnaissance value until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
