CVE-2026-49396

HIGH EPSS 2.4%

Published Jun 12, 20263w ago · Modified Jun 17, 20262w ago

7.1 CVSS 3.1

High

Published Jun 12, 2026 3w ago

Last Modified Jun 17, 2026 2w ago

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14.

CVSS Details

Base Score

7.1

Exploitability

2.8

Impact

4.2

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality None

Integrity High

Availability Low

Threat Intelligence

EPSS Exploit Probability

2.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

References 1

github.com https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.