https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 17:58:39 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-48119 <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users&#39; services. This issue has been patched in version 2.0.12.</p> <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users&#39; services. This issue has been patched in version 2.0.12.</p> https://db.gcve.eu/vuln/fkie_cve-2026-48119 https://db.gcve.eu/vuln/ghsa-4g6j-g789-rghm <p><strong>Affected:</strong> Go: github.com/nezhahq/nezha</p> <p>#### Summary</p> <p>Nezha accepts service-monitor `TaskResult` messages from an authenticated agent based only on whether the reported service ID exists. The dashboard authenticates the agent and derives the reporter server ID from the gRPC stream, but the service-monitor result worker does not verify that the reporter server was selected for that service, belongs to the service owner, or was actually assigned that monitoring task.</p> <p>A low-privilege user with a valid agent secret and one registered agent can therefore submit forged monitoring results for another user&#39;s service ID. This allows cross-tenant corruption of service-monitor history/current state, and can influence victim-owned service notifications with attacker-controlled result text.</p> <p>#### Details</p> <p>The agent task stream accepts inbound `TaskResult` messages after authenticating agent metadata:</p> <p>- `service/rpc/auth.go:23-60` validates `client_secret` and `client_uuid`. - `service/rpc/auth.go:63-75` registers an unknown valid UUID as a server for the authenticated secret owner. - `service/rpc/nezha.go:40-48` authenticates the `RequestTask` stream and binds it to `clientID`. - `service/rpc/nezha.go:50-56` receives agent-controlled `TaskResult` messages. - `proto/nezha.proto:60-65` defines attacker-controlled `TaskResult.id`, `type`, `delay`, `data`, and `successful`.</p> <p>For service-monitor task types, the result is dispatched directly to the service sentinel using the authenticated server ID as reporter:</p> <p>- `service/rpc/nez…</p> <p><strong>Affected:</strong> Go: github.com/nezhahq/nezha</p> <p>#### Summary</p> <p>Nezha accepts service-monitor `TaskResult` messages from an authenticated agent based only on whether the reported service ID exists. The dashboard authenticates the agent and derives the reporter server ID from the gRPC stream, but the service-monitor result worker does not verify that the reporter server was selected for that service, belongs to the service owner, or was actually assigned that monitoring task.</p> <p>A low-privilege user with a valid agent secret and one registered agent can therefore submit forged monitoring results for another user&#39;s service ID. This allows cross-tenant corruption of service-monitor history/current state, and can influence victim-owned service notifications with attacker-controlled result text.</p> <p>#### Details</p> <p>The agent task stream accepts inbound `TaskResult` messages after authenticating agent metadata:</p> <p>- `service/rpc/auth.go:23-60` validates `client_secret` and `client_uuid`. - `service/rpc/auth.go:63-75` registers an unknown valid UUID as a server for the authenticated secret owner. - `service/rpc/nezha.go:40-48` authenticates the `RequestTask` stream and binds it to `clientID`. - `service/rpc/nezha.go:50-56` receives agent-controlled `TaskResult` messages. - `proto/nezha.proto:60-65` defines attacker-controlled `TaskResult.id`, `type`, `delay`, `data`, and `successful`.</p> <p>For service-monitor task types, the result is dispatched directly to the service sentinel using the authenticated server ID as reporter:</p> <p>- `service/rpc/nez…</p> https://db.gcve.eu/vuln/ghsa-4g6j-g789-rghm