CVE-2026-101086

MediumCVSS 6.5

Published: 27/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

23th percentile - higher than 23% of all known CVEs

Summary

Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types. An authenticated user with nezha:service:write scope can submit privileged task types through the service API by exploiting the shared protobuf Task.Type namespace.

Risk Assessment

An attacker can deliver command execution or Agent configuration tasks to Agents within their authorization scope, leading to remote code execution or agent takeover.

Recommendation

Upgrade Nezha Dashboard to version 2.3.5 or later. Restrict nezha:service:write scope to trusted accounts and review API logs for unusual task types.

Other vulnerabilities in Nezha Dashboard

CVE-2026-105113Medium
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.

Original NVD description (English source)

Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. Attackers can deliver command execution or Agent configuration tasks to Agents within their authorization scope by exploiting the shared protobuf Task.Type namespace between service monitors and privileged operations.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS