CVE-2026-49396

HighCVSS 7.1/10Last modified Oct 25, 2026

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
nezhahq	nezha	>= 1.0.0, < 2.0.14

References

Timeline

Published: Jun 12, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-493975.3Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14,CVE-2026-494003.3October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend `SessionMa CVE-2026-494018.4Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restr CVE-2026-494028.1Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation provided an escapeShell CVE-2026-494056.2OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the s CVE-2026-494065.5Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: "manual"), the CVE-2026-494077.7OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local /ws/dictat CVE-2026-494108.1OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site reque CVE-2026-494116.5Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against CVE-2026-494127.8The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the CVE-2026-494137.1The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this fl CVE-2026-494147.8The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rat