Medium severity6.5GHSA Advisory· Published Jun 12, 2026· Updated Jun 15, 2026

CVE-2026-47124

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by HasPermission, but the WebSocket stream treats the presence of any authenticated user as authorization for the full unfiltered server list. This issue has been patched in version 2.0.9.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/nezhahq/nezhaGo	>= 1.4.0, < 1.14.15-0.20260517034128-05e5da253519	1.14.15-0.20260517034128-05e5da253519

Affected products

Nezhahq/NezhaGHSA
Range: >= 1.4.0, < 1.14.15-0.20260517034128-05e5da253519

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-hvv7-hfrh-7gxjghsaADVISORY
github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxjnvdWEB

News mentions

Nezha Monitoring: 13 CVEs Disclosed, Including Critical Command Injection and Path Bypass
Vypr Intelligence · Jun 12, 2026

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000