CVE-2026-49396

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49396", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-29T19:08:01.256Z", "datePublished": "2026-06-12T21:03:28.297Z", "dateUpdated": "2026-06-13T03:41:11.919Z"}, "containers": {"cna": {"title": "Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg"}], "affected": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"version": ">= 1.0.0, < 2.0.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T21:03:28.297Z"}, "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14."}], "source": {"advisory": "GHSA-8qhj-4f8c-j8qg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-13T03:40:13.195038Z", "id": "CVE-2026-49396", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T03:41:11.919Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49396", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-13T03:40:13.195038Z"}}}], "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T03:40:56.370Z"}}], "cna": {"title": "Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents", "source": {"advisory": "GHSA-8qhj-4f8c-j8qg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"status": "affected", "version": ">= 1.0.0, < 2.0.14"}]}], "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg", "name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T21:03:28.297Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49396", "state": "PUBLISHED", "dateUpdated": "2026-06-13T03:41:11.919Z", "dateReserved": "2026-05-29T19:08:01.256Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T21:03:28.297Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nezha", "vendor": "nezhahq", "versions": [{"status": "affected", "version": ">= 1.0.0, < 2.0.14"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14."}, {"lang": "es", "value": "Nezha Monitoring es una herramienta autoalojable, ligera, de monitoreo de servidores y sitios web, y de O&M. Desde la versi\u00f3n 1.0.0 hasta antes de la versi\u00f3n 2.0.14, una solicitud GET entre sitios puede desencadenar comandos cron almacenados en los agentes de una v\u00edctima. Este problema ha sido parcheado en la versi\u00f3n 2.0.14."}], "id": "CVE-2026-49396", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49396", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-13T03:40:13.195038Z", "version": "2.0.3"}}]}, "published": "2026-06-12T22:16:51.677", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,2.0.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nezha", "source": "cna", "vendor": "nezhahq"}, "product": "nezha", "vendor": "nezhahq"}], "created": "2026-06-12T22:30:08.133098+00:00", "updated": "2026-06-13T12:30:13.101796+00:00", "vendors": ["nezhahq", "nezhahq$PRODUCT$nezha"]}