CVE-2026-47268 Details
Description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated Nezha dashboard user can create or update a DDNS profile with provider webhook and configure an arbitrary webhook_url, HTTP method, request body, and headers. When DDNS is triggered for a server that uses that profile, the dashboard process sends the configured request with utils.HttpClient without the SSRF protections used by notification webhooks. This allows a low-privileged authenticated user who controls an owned server/DDNS profile to make the dashboard host issue HTTP requests to loopback or internal network services. The response body is not returned to the attacker in the confirmed path, so this is a blind SSRF / internal state-changing request primitive. This issue has been patched in version 2.0.10.
A blind server-side request forgery (SSRF) vulnerability has been identified in Nezha Monitoring versions 0.20.0 prior to 2.0.10. The issue allows authenticated users to create or update Dynamic DNS (DDNS) profiles with arbitrary webhook URLs, HTTP methods, request bodies, and headers. When the DDNS is triggered for a server using that profile, the dashboard sends the configured request to internal network services or loopback addresses, bypassing existing SSRF protections for notification webhooks. This exploitation is possible for low-privileged authenticated users who control an affected server or DDNS profile.
Users can update to Nezha Monitoring version 2.0.10 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nezha Monitoring | >= 0.20.0, < 2.0.10 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |