CVE-2026-47124 Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members
Authenticated non-admin users can access cross-tenant server telemetry via WebSocket, exposing sensitive monitoring data to unauthorized members.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47124?
CVE-2026-47124 is a medium-severity missing authorization vulnerability in nezhahq nezha, published on 12 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by HasPermission, but the WebSocket stream treats the presence of any authenticated user as authorization for the full unfiltered server list. This issue has been patched in version 2.0.9.
Weakness: CWE-200
Which versions are affected by CVE-2026-47124?
3 open source packages ship an affected version, including github.com/nezhahq/nezha.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nezhahq/nezha Go | From 1.4.0 | 1.14.15-0.20260517034128-05e5da253519 |
github.com/nezhahq/nezha Go | From 1.4.0 | 1.14.15-0.20260517034128-05e5da253519 |
github.com/nezhahq/nezha Go | From 1.4.0 | 1.14.15-0.20260517034128-05e5da253519 |
How do I fix CVE-2026-47124?
Upgrade github.com/nezhahq/nezha to 1.14.15-0.20260517034128-05e5da253519 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47124 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47124 exists.
Sources
Also known as GHSA-hvv7-hfrh-7gxj, GO-2026-5439.