CVE-2026-47120: Nezha Monitoring Authorization Bypass in Cron Task Execution

Technical summary

CVE-2026-47120 is an improper access control vulnerability in Nezha Monitoring's AlertRule.FailTriggerTasks function. The flaw stems from missing ownership validation when RoleMembers attempt to execute cron tasks. An authenticated attacker with RoleMember or higher role can invoke task execution regardless of who created or owns the task. The vulnerability is rooted in CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization), indicating both a failure to enforce access controls and flawed permission logic. The attack requires network access and valid credentials but no user interaction from the victim.

Business impact

Organizations running affected Nezha Monitoring instances face disruption to their monitoring and operations tooling. An insider or compromised account with basic RoleMember privileges could repeatedly trigger cron tasks, causing alert storms, database overload, or cascading failures in dependent systems if those tasks perform system modifications. In shared multi-tenant Nezha deployments, users could interfere with each other's automation. The integrity impact is moderate—while direct data modification isn't possible through this vector, the availability of monitoring and automation services is compromised, reducing operational visibility and increasing incident response times.

Affected systems

Nezha Monitoring versions 1.4.0 through 2.0.7 are vulnerable. Version 2.0.8 and later contain the fix. Self-hosted instances are at risk; cloud-hosted variants (if any) depend on the provider's update status. Any deployment where multiple users or teams share a Nezha instance with varying role assignments should be treated as at-risk until patching is confirmed.

Exploitability

Exploitability is straightforward for an authenticated attacker. No special tooling or complex exploitation technique is required—an attacker with valid RoleMember credentials can directly invoke the vulnerable API or UI function to trigger arbitrary cron tasks. However, the attacker must already have legitimate access to the Nezha system, limiting the threat to insiders, compromised internal accounts, or organizations with overly permissive account provisioning. The vulnerability is not in CISA's Known Exploited Vulnerabilities catalog, suggesting limited public weaponization as of the publication date, though the low technical barrier means exploitation is likely if the flaw becomes widely known.

Remediation

Upgrade Nezha Monitoring to version 2.0.8 or later. Before upgrading, audit logs or task execution records to detect any unauthorized task triggers by RoleMembers. Implement network segmentation and access controls to restrict who can reach the Nezha instance, and review role assignments to ensure least-privilege access. If immediate patching is not feasible, temporarily restrict RoleMember role assignments to trusted personnel only, and monitor for suspicious task execution patterns.

Patch guidance

Apply Nezha Monitoring version 2.0.8 or any subsequent release. Consult the vendor's release notes and upgrade documentation for any pre-upgrade checks or database migration requirements. Test the upgrade in a staging environment first, especially if you rely heavily on cron task automation. Once patched, verify that the ownership check is now enforced by attempting to trigger a task owned by another user—the system should deny the request.

Detection guidance

Review Nezha Monitoring audit logs for cron task executions where the triggering user differs from the task owner, particularly if execution was initiated by lower-privileged RoleMembers. Check for repeated task triggers in a short timeframe, which may indicate automated exploitation. Monitor system logs on hosts running Nezha for unusual process spawning or resource consumption tied to cron task execution. If available, enable verbose logging in AlertRule execution to capture task invocation metadata.

Why prioritize this

This vulnerability merits rapid patching because it affects a critical operational tool (monitoring and automation), exploitability is trivial for authenticated users, and the impact on system availability and integrity is significant. Although it requires prior authentication, the low barrier to exploitation combined with the potential for operational disruption elevates risk in environments with weak access controls or high insider threat risk. Organizations managing large infrastructure fleets via Nezha should prioritize this patch to restore monitoring integrity.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects the combination of network-accessible attack vector, low attack complexity, and the requirement for low privileges (authenticated access). The score weights the high integrity impact (unauthorized task execution) and low availability impact against the lack of confidentiality impact. The score appropriately captures the real-world risk: an authenticated attacker can disrupt automation and monitoring, but cannot steal data or gain direct system access through this vector alone.

Frequently asked questions