CVE-2026-47268

{
  "id": "CVE-2026-47268",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T22:16:51.390",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated Nezha dashboard user can create or update a DDNS profile with provider webhook and configure an arbitrary webhook_url, HTTP method, request body, and headers. When DDNS is triggered for a server that uses that profile, the dashboard process sends the configured request with utils.HttpClient without the SSRF protections used by notification webhooks. This allows a low-privileged authenticated user who controls an owned server/DDNS profile to make the dashboard host issue HTTP requests to loopback or internal network services. The response body is not returned to the attacker in the confirmed path, so this is a blind SSRF / internal state-changing request primitive. This issue has been patched in version 2.0.10."
    },
    {
      "lang": "es",
      "value": "Nezha Monitoring es una herramienta autoalojable, ligera, de monitoreo de servidores y sitios web y O&M. Desde la versión 0.20.0 hasta antes de la versión 2.0.10, un usuario autenticado del panel de control de Nezha puede crear o actualizar un perfil DDNS con webhook de proveedor y configurar una webhook_url, método HTTP, cuerpo de la solicitud y encabezados arbitrarios. Cuando se activa el DDNS para un servidor que usa ese perfil, el proceso del panel de control envía la solicitud configurada con utils.HttpClient sin las protecciones SSRF utilizadas por los webhooks de notificación. Esto permite a un usuario autenticado con pocos privilegios que controla un servidor/perfil DDNS propio hacer que el host del panel de control emita solicitudes HTTP a servicios de loopback o de red interna. El cuerpo de la respuesta no se devuelve al atacante en la ruta confirmada, por lo que esto es un SSRF ciego / primitiva de solicitud de cambio de estado interno. Este problema ha sido parcheado en la versión 2.0.10."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nezhahq",
          "product": "nezha",
          "versions": [
            {
              "version": ">= 0.20.0, < 2.0.10",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-15T12:57:46.041711Z",
          "id": "CVE-2026-47268",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-6x26-5727-rrm9",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}