CVE-2026-47268

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47268", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T23:03:37.229Z", "datePublished": "2026-06-12T20:56:45.935Z", "dateUpdated": "2026-06-15T12:58:14.279Z"}, "containers": {"cna": {"title": "Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9"}], "affected": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"version": ">= 0.20.0, < 2.0.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T20:56:45.935Z"}, "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated Nezha dashboard user can create or update a DDNS profile with provider webhook and configure an arbitrary webhook_url, HTTP method, request body, and headers. When DDNS is triggered for a server that uses that profile, the dashboard process sends the configured request with utils.HttpClient without the SSRF protections used by notification webhooks. This allows a low-privileged authenticated user who controls an owned server/DDNS profile to make the dashboard host issue HTTP requests to loopback or internal network services. The response body is not returned to the attacker in the confirmed path, so this is a blind SSRF / internal state-changing request primitive. This issue has been patched in version 2.0.10."}], "source": {"advisory": "GHSA-6x26-5727-rrm9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T12:57:46.041711Z", "id": "CVE-2026-47268", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T12:58:14.279Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47268", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T12:57:46.041711Z"}}}], "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T12:58:10.231Z"}}], "cna": {"title": "Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host", "source": {"advisory": "GHSA-6x26-5727-rrm9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"status": "affected", "version": ">= 0.20.0, < 2.0.10"}]}], "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9", "name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated Nezha dashboard user can create or update a DDNS profile with provider webhook and configure an arbitrary webhook_url, HTTP method, request body, and headers. When DDNS is triggered for a server that uses that profile, the dashboard process sends the configured request with utils.HttpClient without the SSRF protections used by notification webhooks. This allows a low-privileged authenticated user who controls an owned server/DDNS profile to make the dashboard host issue HTTP requests to loopback or internal network services. The response body is not returned to the attacker in the confirmed path, so this is a blind SSRF / internal state-changing request primitive. This issue has been patched in version 2.0.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T20:56:45.935Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47268", "state": "PUBLISHED", "dateUpdated": "2026-06-15T12:58:14.279Z", "dateReserved": "2026-05-18T23:03:37.229Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T20:56:45.935Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nezha", "vendor": "nezhahq", "versions": [{"status": "affected", "version": ">= 0.20.0, < 2.0.10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated Nezha dashboard user can create or update a DDNS profile with provider webhook and configure an arbitrary webhook_url, HTTP method, request body, and headers. When DDNS is triggered for a server that uses that profile, the dashboard process sends the configured request with utils.HttpClient without the SSRF protections used by notification webhooks. This allows a low-privileged authenticated user who controls an owned server/DDNS profile to make the dashboard host issue HTTP requests to loopback or internal network services. The response body is not returned to the attacker in the confirmed path, so this is a blind SSRF / internal state-changing request primitive. This issue has been patched in version 2.0.10."}, {"lang": "es", "value": "Nezha Monitoring es una herramienta autoalojable, ligera, de monitoreo de servidores y sitios web y O&M. Desde la versi\u00f3n 0.20.0 hasta antes de la versi\u00f3n 2.0.10, un usuario autenticado del panel de control de Nezha puede crear o actualizar un perfil DDNS con webhook de proveedor y configurar una webhook_url, m\u00e9todo HTTP, cuerpo de la solicitud y encabezados arbitrarios. Cuando se activa el DDNS para un servidor que usa ese perfil, el proceso del panel de control env\u00eda la solicitud configurada con utils.HttpClient sin las protecciones SSRF utilizadas por los webhooks de notificaci\u00f3n. Esto permite a un usuario autenticado con pocos privilegios que controla un servidor/perfil DDNS propio hacer que el host del panel de control emita solicitudes HTTP a servicios de loopback o de red interna. El cuerpo de la respuesta no se devuelve al atacante en la ruta confirmada, por lo que esto es un SSRF ciego / primitiva de solicitud de cambio de estado interno. Este problema ha sido parcheado en la versi\u00f3n 2.0.10."}], "id": "CVE-2026-47268", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47268", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T12:57:46.041711Z", "version": "2.0.3"}}]}, "published": "2026-06-12T22:16:51.390", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.20.0,2.0.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nezha", "source": "cna", "vendor": "nezhahq"}, "product": "nezha", "vendor": "nezhahq"}], "created": "2026-06-12T22:30:08.134379+00:00", "updated": "2026-06-13T12:30:37.444823+00:00", "vendors": ["nezhahq", "nezhahq$PRODUCT$nezha"]}