GO-2026-5282
Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron in github.com/nezhahq/nezha
At a glance
- Published
- Updated
- CVE
- CVE-2026-46716
- Aliases
- GHSA-99gv-2m7h-3hh9
Description
Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron in github.com/nezhahq/nezha
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/nezhahq/nezha | introduced 1.4.0, fixed 1.14.15-0.20260517022419-d7526351cf97 |
References
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |