CVE-2026-49397

MEDIUM EPSS 16.5%

Published Jun 12, 20263w ago · Modified Jun 17, 20262w ago

5.3 CVSS 3.1

Medium

Published Jun 12, 2026 3w ago

Last Modified Jun 17, 2026 2w ago

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14, private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data. This issue has been patched in version 2.0.14.

CVSS Details

Base Score

5.3

Exploitability

3.9

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

16.5% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 3

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

CWE-285

CWE-863 Incorrect Authorization Authorization

References 1

github.com https://github.com/nezhahq/nezha/security/advisories/GHSA-vrmh-5mmx-hjwx

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.