{"id":"CVE-2026-126307","kind":"vulnerability","aliases":["CVE-2026-126307"],"related":[],"title":"Nezha Dashboard: authorization and tenant flaws let attackers hijack features","description":"Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests.","summary":"Nezha Dashboard versions before 2.6.0 contain several authorization and tenant isolation flaws across its NAT, DDNS, OAuth, cron and server transfer features. An attacker can capture login bodies, hijack DDNS profiles, create schedules that run commands without exec permission, or exhaust memory through buffered NAT requests.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Nezha Dashboard","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["monitoring","nezha-dashboard","other","self-hosted"],"not_affected_if":["version-2.6.0-or-later"],"how_to_check":"- Check the installed Nezha Dashboard version against the product range in the sources (before 2.6.0 is affected).\n- Confirm whether the NAT, DDNS, OAuth, cron or server transfer features are enabled on the dashboard.","fix":"- Nezha Dashboard: move to `2.6.0` or later.","status":"open","published_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","triaged_at":"2026-11-13T10:50:27+00:00","updated_at":"2026-11-13T10:50:27+00:00","category":"other","confidence":0.55,"triage":{"at":"2026-11-13T10:50:27Z","model":"claude-haiku-5-5","output":{"fix":"- Nezha Dashboard: move to `2.6.0` or later.","reach":"internet","title":"Nezha Dashboard: authorization and tenant flaws let attackers hijack features","impact":"medium","summary":"Nezha Dashboard versions before 2.6.0 contain several authorization and tenant isolation flaws across its NAT, DDNS, OAuth, cron and server transfer features. An attacker can capture login bodies, hijack DDNS profiles, create schedules that run commands without exec permission, or exhaust memory through buffered NAT requests.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nezha-dashboard","self-hosted","monitoring"],"confidence":0.55,"fix_status":"available","needs_auth":"unknown","worst_case":"Attackers hijack DDNS profiles, capture logins, or exhaust server memory","analyst_note":"Confirm which features are affected by default and the exact fixed version from the NVD and the linked GitHub patch and advisory pages.","how_to_check":"- Check the installed Nezha Dashboard version against the product range in the sources (before 2.6.0 is affected).\n- Confirm whether the NAT, DDNS, OAuth, cron or server transfer features are enabled on the dashboard.","plain_action":"","product_name":"Nezha Dashboard","needs_analyst":true,"not_affected_if":["version-2.6.0-or-later"],"who_is_affected":"Teams that run a self-hosted Nezha Dashboard below 2.6.0 are exposed, especially if they use NAT, DDNS, OAuth, cron or server transfer features or have members other than admins. The sources do not say whether a default configuration is affected, so check which features are in use.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000795,"input_tokens":4680,"output_tokens":653,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126307':13A,16A '-2026':12A,15A '2.6.0':31B,76C 'abus':93C 'across':39B 'allow':87C 'attack':8A,50B,91C,102C 'author':3A,34B,79C 'bodi':54B,111C 'buffer':70B,125C 'captur':52B,109C 'claim':104C 'command':62B 'contain':32B,77C 'creat':58B,115C 'cron':44B,97C 'cve':11A,14A 'dashboard':2A,18A,22B,28B,74C,106C 'ddns':42B,56B,95C,113C 'exec':64B,119C 'execut':116C 'exhaust':67B,84C,122C 'featur':10A,48B,101C 'flaw':6A,38B 'hijack':9A,55B,112C 'host':26B 'hostnam':107C 'isol':37B,81C 'let':7A 'login':53B,110C 'member':88C 'memori':68B,123C 'monitor':19B 'multipl':78C 'nat':41B,71B,94C,126C 'nezha':1A,17A,21B,27B,73C 'nezha-dashboard':20B 'oauth':43B,96C 'permiss':65B 'profil':57B,114C 'request':72B,127C 'resourc':83C 'run':61B 'schedul':59B,117C 'scope':120C 'self':25B 'self-host':24B 'server':46B,99C 'sever':33B 'tenant':5A,36B,80C 'transfer':47B,100C 'unauthent':90C 'undeclar':105C 'version':29B 'via':124C 'vulner':85C 'without':63B,118C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Nezha Dashboard below 2.6.0 are exposed, especially if they use NAT, DDNS, OAuth, cron or server transfer features or have members other than admins. The sources do not say whether a default configuration is affected, so check which features are in use.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dashboard","nezhadashboard"],"ptokens":["dashboard","nezha"],"labels":["high","monitoring","nezhadashboard","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126307':13A,16A '-2026':12A,15A 'attack':8A 'author':3A 'cve':11A,14A 'dashboard':2A,18A 'featur':10A 'flaw':6A 'hijack':9A 'let':7A 'nezha':1A,17A 'tenant':5A","search_b":"'2.6.0':31B 'across':39B 'attack':50B 'author':34B 'bodi':54B 'buffer':70B 'captur':52B 'command':62B 'contain':32B 'creat':58B 'cron':44B 'dashboard':22B,28B 'ddns':42B,56B 'exec':64B 'exhaust':67B 'featur':48B 'flaw':38B 'hijack':55B 'host':26B 'isol':37B 'login':53B 'memori':68B 'monitor':19B 'nat':41B,71B 'nezha':21B,27B 'nezha-dashboard':20B 'oauth':43B 'permiss':65B 'profil':57B 'request':72B 'run':61B 'schedul':59B 'self':25B 'self-host':24B 'server':46B 'sever':33B 'tenant':36B 'transfer':47B 'version':29B 'without':63B","search_c":"'2.6.0':76C 'abus':93C 'allow':87C 'attack':91C,102C 'author':79C 'bodi':111C 'buffer':125C 'captur':109C 'claim':104C 'contain':77C 'creat':115C 'cron':97C 'dashboard':74C,106C 'ddns':95C,113C 'exec':119C 'execut':116C 'exhaust':84C,122C 'featur':101C 'hijack':112C 'hostnam':107C 'isol':81C 'login':110C 'member':88C 'memori':123C 'multipl':78C 'nat':94C,126C 'nezha':73C 'oauth':96C 'profil':114C 'request':127C 'resourc':83C 'schedul':117C 'scope':120C 'server':99C 'tenant':80C 'transfer':100C 'unauthent':90C 'undeclar':105C 'via':124C 'vulner':85C 'without':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T01:39:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126307","severity":null,"published_at":"2026-11-13T10:17:36+00:00","modified_at":"2026-11-13T10:17:36+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","fetched_at":"2026-11-13T10:47:15+00:00","note":null}],"documents":[{"id":144943,"url":"https://github.com/nezhahq/nezha/commit/027bfcf6521f192635b946b7583c3ab39500ab98","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":144944,"url":"https://github.com/nezhahq/nezha/commit/7cd0371b56f7bce83c3953b2bf4711b2105d5818","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":144945,"url":"https://github.com/nezhahq/nezha/security/advisories/GHSA-63mg-cxm4-98q3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T01:39:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144946,"url":"https://www.vulncheck.com/advisories/nezha-dashboard-before-2.6.0-multiple-authorization-and-tenant-isolation-flaws","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}