Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-46716. PoCs published by HAERIN-L.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2026-46716, demonstrating a cron job delivery bypass in Nezha Monitoring due to missing ownership validation for empty server lists. The exploit script automates setup, triggering, and cleanup of vulnerable and patched environments.
Description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.
Exploits (1)
This repository contains a functional exploit PoC for CVE-2026-46716, demonstrating a cron job delivery bypass in Nezha Monitoring due to missing ownership validation for empty server lists. The exploit script automates setup, triggering, and cleanup of vulnerable and patched environments.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H