{"id":"EUVD-2026-36591","enisaUuid":"066872e1-0bc6-37b5-96c4-18535b6bfcb3","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover\u003dCronCoverAll, Servers\u003d[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin\u0027s servers, other members\u0027 servers). Each agent runs the command and returns the output, which is then sent to the attacker\u0027s own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.","datePublished":"Jun 12, 2026, 9:00:46 PM","dateUpdated":"Jun 15, 2026, 7:27:36 PM","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9\n","aliases":"CVE-2026-46716\nGHSA-99gv-2m7h-3hh9\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"7dcc3d7f-2bf8-3484-9667-43cea088a4e9","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.4.0, \u003c 2.0.8"}],"enisaIdVendor":[{"id":"7b2ffd03-25da-31bc-8d10-03ce4df24e84","vendor":{"name":"nezhahq"}}],"enisaIdVulnerability":[{"id":"9329feac-58e6-37ab-b3a9-e721c4a5cf5a","vulnerability":{"id":"GHSA-99gv-2m7h-3hh9","description":"Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron","datePublished":"May 23, 2026, 12:17:58 AM","dateUpdated":"Jun 26, 2026, 9:28:22 PM","baseScore":0.0,"references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46716\nhttps://github.com/nezhahq/nezha\n","enisa_id":"EUVD-2026-36591\n","aliases":"GHSA-99gv-2m7h-3hh9\nCVE-2026-46716\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"cc4f0bd5-9b0d-313f-9c3d-51085d1dc326","vulnerability":{"id":"CVE-2026-46716","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover\u003dCronCoverAll, Servers\u003d[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin\u0027s servers, other members\u0027 servers). Each agent runs the command and returns the output, which is then sent to the attacker\u0027s own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.","datePublished":"Jun 12, 2026, 9:00:46 PM","dateUpdated":"Jun 15, 2026, 7:27:36 PM","status":"PUBLISHED","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9\n","enisa_id":"EUVD-2026-36591\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Nov 7, 2026, 7:22:17 AM","vulnerabilityProduct":[{"id":"abb7fb03-85f0-34b3-ae29-7e7c4a37eb86","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.4.0, \u003c 2.0.8"}],"vulnerabilityVendor":[{"id":"08db075f-cfe9-3a55-8678-601c354d2ab4","vendor":{"name":"nezhahq"}}]}}],"enisaIdAdvisory":[]}