PT-2026-42872 · Unknown · Nezha Monitoring

Published 2026-05-23 · Updated 2026-06-25 · CVE-2026-47124

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.4.0 through 2.0.8

Description Authenticated non-admin members can connect to the server-status WebSocket endpoint '/api/v1/ws/server' and receive telemetry for all servers, including those owned by other users. While the standard server list API filters objects using the HasPermission function, the WebSocket stream incorrectly treats any authenticated user as authorized to access the full, unfiltered server list. This results in the disclosure of sensitive telemetry, including host platform details, agent versions, CPU/GPU specifications, resource usage, network traffic, and operational states across different tenants.

Recommendations Update to version 2.0.9.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-47124

GHSA-HVV7-HFRH-7GXJ

GO-2026-5439

Affected Products

Nezha Monitoring

References · 10

• 🔥 https://github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47124.json · Exploit
• https://osv.dev/vulnerability/GHSA-hvv7-hfrh-7gxj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47124 · Security Note
• https://osv.dev/vulnerability/GO-2026-5439 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47124 · Vendor Advisory
• https://github.com/nezhahq/nezha · Note
• https://reddit.com/r/VulnMatter/comments/1tna2wo/resumen_diario_de_vulnerabilidades_25052026 · Reddit Post
• https://twitter.com/CVEnew/status/2066216150803882056 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1to7zxa/resumen_diario_de_vulnerabilidades_26052026 · Reddit Post