CVE-2026-126307

CVSS 8.7 (high) · published 2026-11-13

Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests.

Weakness: CWE-863

Source: NVD CVE-2026-126307

References

• https://github.com/nezhahq/nezha/commit/027bfcf6521f192635b946b7583c3ab39500ab98
• https://github.com/nezhahq/nezha/commit/7cd0371b56f7bce83c3953b2bf4711b2105d5818
• https://github.com/nezhahq/nezha/security/advisories/GHSA-63mg-cxm4-98q3
• https://www.vulncheck.com/advisories/nezha-dashboard-before-2.6.0-multiple-authorization-and-tenant-isolation-flaws

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.