PT-2026-45048 · Go+1 · Github.Com/Nezhahq/Nezha+1

Published 2026-05-29 · Updated 2026-06-14 · CVE-2026-47268

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 0.20.0 through 2.0.9

Description An authenticated user with low privileges can perform a blind Server-Side Request Forgery (SSRF) by creating or updating a DDNS profile. By configuring a provider webhook with an arbitrary webhook url, HTTP method, request body, and headers, the user can force the dashboard host to send HTTP requests to loopback or internal network services. This occurs because the utils.HttpClient used in the DDNS process lacks the SSRF protections implemented for notification webhooks. This allows an attacker to probe internal HTTP services or trigger state-changing requests on internal endpoints that trust private network origins. The issue involves the following endpoints:

• 'GET /api/v1/ddns'
• 'POST /api/v1/ddns'
• 'PATCH /api/v1/ddns/:id'

Technical details indicate that the WebhookURL, WebhookMethod, WebhookRequestType, WebhookRequestBody, and WebhookHeaders variables are copied directly from JSON request bodies into the model.DDNSProfile without validation of the scheme, host, or IP range.

Recommendations Update Nezha Monitoring to version 2.0.10.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-47268

GHSA-6X26-5727-RRM9

Affected Products

Github.Com/Nezhahq/Nezha

Nezha

References · 6

• 🔥 https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47268 · Security Note
• https://osv.dev/vulnerability/GHSA-6x26-5727-rrm9 · Vendor Advisory
• https://github.com/nezhahq/nezha · Note
• https://reddit.com/r/VulnMatter/comments/1ttruru/resumen_diario_de_vulnerabilidades_01062026 · Reddit Post
• https://twitter.com/CVEnew/status/2066216157875429534 · Twitter Post