6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47124

CVE-2026-47124: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by HasPermission, but the WebSocket stream treats the presence of any authenticated user as authorization for the full unfiltered server list. This issue has been patched in version 2.0.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47124

CVE-2026-47124:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/nezhahq/nezha	go	>= 1.4.0, < 1.14.15-0.20260517034128-05e5da253519	1.14.15-0.20260517034128-05e5da253519

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability existed in the WebSocket endpoint for streaming server status (/ws/server). The handler for this endpoint, serverStream, determined if a user was authenticated and passed a simple boolean isMember to the getServerStat function. The getServerStat function, in turn, used this boolean to decide whether to return telemetry for all servers on the platform or a restricted "guest" view. The flaw was that any authenticated user, regardless of their administrative status or server ownership, was considered fully "authorized," granting them access to the unfiltered list of all servers and their detailed telemetry. The fix involves passing the specific user's ID and admin status down to getServerStat and introducing a new function, filterServersForViewer, which performs a proper per-server authorization check, ensuring users can only see data for servers they own or if they are an administrator.

Vulnerable functions

serverStream

cmd/dashboard/controller/ws.go

This function handles the WebSocket connection for streaming server status. It incorrectly determined authorization by just checking if a user is authenticated (`isMember`) and passed this insufficient authorization check to `getServerStat`, leading to the disclosure of all server data.

getServerStat

cmd/dashboard/controller/ws.go

This function was vulnerable because it used a simple boolean `authorized` to determine if a user could see all server statistics. Any authenticated user was considered "authorized", bypassing per-server ownership checks. If `authorized` was true, it returned a list of all servers on the instance (`singleton.ServerShared.GetSortedList()`) without checking if the user had permission to view each server, leading to a cross-tenant information disclosure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.