NEZHA DASHBOARD · CVE-2026-126307 · Other
NO FIX YET · SEE WHAT TO DO
Nezha Dashboard versions before 2.6.0 contain several authorization and tenant isolation flaws across its NAT, DDNS, OAuth, cron and server transfer features. An attacker can capture login bodies, hijack DDNS profiles, create schedules that run commands without exec permission, or exhaust memory through buffered NAT requests.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run a self-hosted Nezha Dashboard below 2.6.0 are exposed, especially if they use NAT, DDNS, OAuth, cron or server transfer features or have members other than admins. The sources do not say whether a default configuration is affected, so check which features are in use.
Not affected if version-2.6.0-or-later
Who cares monitoring, nezha-dashboard, self-hosted
2.6.0 or later.Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.