Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in two API endpoint handlers, getServiceHistory and listServerServices, within cmd/dashboard/controller/service.go. These functions were responsible for retrieving service information but failed to enforce the EnableShowInService privacy flag, which is intended to hide services from public view. The root cause was that these functions used underlying data access methods (ServiceSentinel.Get and ServiceSentinel.GetSortedList) that returned all services, including private ones, without any authorization checks. An unauthenticated attacker could exploit this by making requests to the corresponding API endpoints (/api/v1/service/:id/history and /api/v1/server/:id/service). This would leak the names and timing data of private services, exposing sensitive information about the monitored infrastructure. The patch introduced a new function, userCanViewService, which centralizes the authorization logic and is now called by both getServiceHistory and listServerServices to ensure that only authorized users (or public services) are returned.
getServiceHistorycmd/dashboard/controller/service.go
listServerServicescmd/dashboard/controller/service.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/nezhahq/nezha | go | >= 2.0.0, < 2.0.14 | 2.0.14 |