CVE-2026-48119

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48119", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:46:58.290Z", "datePublished": "2026-06-12T21:03:17.672Z", "dateUpdated": "2026-06-15T19:27:29.041Z"}, "containers": {"cna": {"title": "Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm"}], "affected": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"version": ">= 0.20.0, < 2.0.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T21:03:17.672Z"}, "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users' services. This issue has been patched in version 2.0.12."}], "source": {"advisory": "GHSA-4g6j-g789-rghm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T17:05:16.195138Z", "id": "CVE-2026-48119", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T19:27:29.041Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48119", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:46:58.290Z", "datePublished": "2026-06-12T21:03:17.672Z", "dateUpdated": "2026-06-15T19:27:29.041Z"}, "containers": {"cna": {"title": "Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm"}], "affected": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"version": ">= 0.20.0, < 2.0.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T21:03:17.672Z"}, "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users' services. This issue has been patched in version 2.0.12."}], "source": {"advisory": "GHSA-4g6j-g789-rghm", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48119", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:05:16.195138Z"}}}], "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T17:05:29.712Z"}}]}}

{"affected": [{"affectedData": [{"product": "nezha", "vendor": "nezhahq", "versions": [{"status": "affected", "version": ">= 0.20.0, < 2.0.12"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users' services. This issue has been patched in version 2.0.12."}, {"lang": "es", "value": "Nezha Monitoring es una herramienta autoalojable, ligera, de monitoreo de servidores y sitios web, y de O&M. Desde la versi\u00f3n 0.20.0 hasta antes de la versi\u00f3n 2.0.12, los agentes autenticados pueden falsificar los resultados del monitoreo de servicios para los servicios de otros usuarios. Este problema ha sido parcheado en la versi\u00f3n 2.0.12."}], "id": "CVE-2026-48119", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48119", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T17:05:16.195138Z", "version": "2.0.3"}}]}, "published": "2026-06-12T22:16:51.540", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.20.0,2.0.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nezha", "source": "cna", "vendor": "nezhahq"}, "product": "nezha", "vendor": "nezhahq"}], "created": "2026-06-12T23:00:08.888809+00:00", "updated": "2026-06-13T12:30:15.657271+00:00", "vendors": ["nezhahq", "nezhahq$PRODUCT$nezha"]}