CVE-2026-46716
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk38th percentile — higher than 38% of all known CVEs
Summary
Nezha Monitoring versions from 1.4.0 to before 2.0.8 allow RoleMember users to create scheduled cron tasks that can execute arbitrary commands on servers, including those belonging to other users. This poses a risk of unauthorized access to systems.
Risk Assessment
The organization may be exposed to unauthorized command execution on servers, potentially leading to data leaks or system takeover.
Recommendation
It is recommended to upgrade to version 2.0.8 or later to mitigate this vulnerability and to review and restrict permissions for RoleMember users.
Original NVD description (English source)
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.