CVE-2026-126307
Nezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation Flaws
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests.
| CWE | CWE-863 |
| Vendor | nezhahq |
| Product | nezha |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for nezhahq nezha
Be the first to know when new high vulnerabilities affecting nezhahq nezha are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
nezhahq / nezha
0 < 2.6.0
References
github.com: https://github.com/nezhahq/nezha/security/advisories/GHSA-63mg-cxm4-98q3 github.com: https://github.com/nezhahq/nezha/commit/027bfcf6521f192635b946b7583c3ab39500ab98 github.com: https://github.com/nezhahq/nezha/commit/7cd0371b56f7bce83c3953b2bf4711b2105d5818 vulncheck.com: https://www.vulncheck.com/advisories/nezha-dashboard-before-2.6.0-multiple-authorization-and-tenant-isolation-flaws
Credits
🔍 chaconneX