7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47120

CVE-2026-47120: Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check). This issue has been patched in version 2.0.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47120

CVE-2026-47120:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/nezhahq/nezha	go	>= 1.4.0, < 1.14.15-0.20260517022419-d7526351cf97	1.14.15-0.20260517022419-d7526351cf97

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a low-privileged user (RoleMember) to execute cron jobs belonging to other users, including administrators. This is possible because the application fails to validate the ownership of cron task IDs provided in FailTriggerTasks and RecoverTriggerTasks when a user creates or updates an alert rule or a service monitor. The functions createAlertRule, updateAlertRule, createService, and updateService accept these task IDs without proper validation from the validateRule and validateServers functions. When an alert or service is triggered, the SendTriggerTasks function is called, which, in the vulnerable version, executes the specified cron tasks without any ownership check. This could lead to unauthorized remote command execution on all servers managed by the Nezha monitoring system, as an attacker could trigger cron jobs created by an administrator. The patch for this vulnerability introduces an ownership check within the SendTriggerTasks function, ensuring that the user triggering the task is the owner of the cron job or an administrator.

Vulnerable functions

createAlertRule

cmd/dashboard/controller/alertrule.go

This function allows a user to create an alert rule and associate it with cron tasks (`FailTriggerTasks` and `RecoverTriggerTasks`) that they do not own, because it does not perform any ownership validation on the provided task IDs.

validateRule

cmd/dashboard/controller/alertrule.go

This validation function is called by `createAlertRule` and `updateAlertRule` but it fails to check the ownership of the cron tasks specified in `FailTriggerTasks` and `RecoverTriggerTasks`, thus allowing a user to use other users' cron tasks.

createService

cmd/dashboard/controller/service.go

Similar to `createAlertRule`, this function allows a user to create a service monitor and associate it with cron tasks they do not own.

validateServers

cmd/dashboard/controller/service.go

This validation function, used for services, fails to validate the ownership of the cron tasks, similar to `validateRule`.

CronClass.SendTriggerTasks

service/singleton/crontask.go

This function is responsible for executing the trigger tasks. In the vulnerable version, it iterates through the provided task IDs and executes them without verifying if the user who triggered the alert or service has the permission to run those cron tasks. This allows a low-privileged user to execute cron tasks owned by other users, including administrators.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.