---
id: "CVE-2026-126307"
page: "https://infrastack.ai/live/CVE-2026-126307"
kind: "vulnerability"
aliases: ["CVE-2026-126307"]
title: "Nezha Dashboard: authorization and tenant flaws let attackers hijack features"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Nezha Dashboard", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["monitoring", "nezha-dashboard", "other", "self-hosted"]
not_affected_if: ["version-2.6.0-or-later"]
published_at: "2026-11-13T10:17:36+00:00"
first_seen_at: "2026-11-13T10:47:15+00:00"
updated_at: "2026-11-13T10:50:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126307", "first_seen_at": "2026-11-13T10:47:15+00:00"}]
exploit_sources: []
---

# Nezha Dashboard: authorization and tenant flaws let attackers hijack features

Link for people: https://infrastack.ai/live/CVE-2026-126307 (this .md is for agents)

Nezha Dashboard versions before 2.6.0 contain several authorization and tenant isolation flaws across its NAT, DDNS, OAuth, cron and server transfer features. An attacker can capture login bodies, hijack DDNS profiles, create schedules that run commands without exec permission, or exhaust memory through buffered NAT requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nezha Dashboard affected range not listed fixed no fixed version listed

## How to check

- Check the installed Nezha Dashboard version against the product range in the sources (before 2.6.0 is affected).
- Confirm whether the NAT, DDNS, OAuth, cron or server transfer features are enabled on the dashboard.

## Fix

- Nezha Dashboard: move to `2.6.0` or later.

## Timeline

- 2026-11-13T10:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126307

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nezhahq/nezha/security/advisories/GHSA-63mg-cxm4-98q3
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nezha-dashboard-before-2.6.0-multiple-authorization-and-tenant-isolation-flaws
- [fix] Patch: github.com https://github.com/nezhahq/nezha/commit/027bfcf6521f192635b946b7583c3ab39500ab98
- [fix] Patch: github.com https://github.com/nezhahq/nezha/commit/7cd0371b56f7bce83c3953b2bf4711b2105d5818

## From the sources

Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_