CVE-2026-46717

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46717", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-15T23:26:58.310Z", "datePublished": "2026-06-12T21:02:40.951Z", "dateUpdated": "2026-06-13T03:38:33.513Z"}, "containers": {"cna": {"title": "Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532"}], "affected": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"version": ">= 1.4.0, < 2.0.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T21:02:40.951Z"}, "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler \u2014 so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8."}], "source": {"advisory": "GHSA-w4g9-mxgg-j532", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-13T03:38:02.540135Z", "id": "CVE-2026-46717", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T03:38:33.513Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46717", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-13T03:38:02.540135Z"}}}], "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T03:38:25.314Z"}}], "cna": {"title": "Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification", "source": {"advisory": "GHSA-w4g9-mxgg-j532", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"status": "affected", "version": ">= 1.4.0, < 2.0.8"}]}], "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532", "name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler \u2014 so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T21:02:40.951Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46717", "state": "PUBLISHED", "dateUpdated": "2026-06-13T03:38:33.513Z", "dateReserved": "2026-05-15T23:26:58.310Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T21:02:40.951Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nezha", "vendor": "nezhahq", "versions": [{"status": "affected", "version": ">= 1.4.0, < 2.0.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler \u2014 so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8."}, {"lang": "es", "value": "Nezha Monitoring es una herramienta autoalojable y ligera para el monitoreo de servidores y sitios web, y para O&M. Desde la versi\u00f3n 1.4.0 hasta antes de la versi\u00f3n 2.0.8, el panel de control de Nezha admite dos roles de usuario: RoleAdmin (Rol==0) y RoleMember (Rol==1). Las rutas de notificaci\u00f3n POST /API/v1/notification y PATCH /API/v1/notification/:id est\u00e1n conectadas a trav\u00e9s de commonHandler en lugar de adminHandler - por lo que un usuario RoleMember puede llamarlas. Estos manejadores Send() sincr\u00f3nicamente una solicitud HTTP a una URL controlada por el usuario y reflejan el cuerpo completo de la respuesta (sin l\u00edmite de tama\u00f1o) de vuelta al llamador en cualquier respuesta que no sea 2xx. Este problema ha sido parcheado en la versi\u00f3n 2.0.8."}], "id": "CVE-2026-46717", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46717", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-13T03:38:02.540135Z", "version": "2.0.3"}}]}, "published": "2026-06-12T22:16:50.957", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.0,2.0.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nezha", "source": "cna", "vendor": "nezhahq"}, "product": "nezha", "vendor": "nezhahq"}], "created": "2026-06-12T23:30:08.556089+00:00", "updated": "2026-06-13T12:30:27.765051+00:00", "vendors": ["nezhahq", "nezhahq$PRODUCT$nezha"]}