CVE-2026-48119: Nezha Monitoring Authenticated Agent Forgery Vulnerability

Technical summary

CVE-2026-48119 is an authorization bypass vulnerability in Nezha Monitoring where authenticated agents lack proper permission checks when submitting service-monitor results. The vulnerability stems from insufficient verification of agent privileges before allowing result submission, enabling agents to report metrics for services outside their authorization scope. This is classified as an Improper Authorization issue (CWE-862). The network-accessible nature of the vulnerability (CVSS vector AV:N) combined with low attack complexity makes it practical to exploit once agent credentials are obtained.

Business impact

The primary business impact is data integrity compromise. Organizations relying on Nezha Monitoring for operational visibility may receive false or manipulated service status information, leading to delayed incident response, masked outages, and compromised decision-making based on inaccurate monitoring data. An attacker could suppress alerts for critical services, create alert fatigue through false positives, or hide infrastructure problems during maintenance windows or attacks. This undermines the core value proposition of monitoring tools—reliable visibility into system health.

Affected systems

Nezha Monitoring versions 0.20.0 through 2.0.11 are vulnerable. Self-hosted installations are at risk if they deploy agents with network access and use multiple monitored services across different users or teams. The vulnerability requires authenticated access, so exposure is limited to environments where agent credentials have been compromised or where untrusted agents have been provisioned.

Exploitability

Exploitation requires valid agent credentials, which limits the attack surface to scenarios where agent keys are compromised, shared insecurely, or provisioned to untrusted systems. Once credentials are obtained, the attack is straightforward: an authenticated agent can submit forged results for any monitored service without requiring further interaction. The low attack complexity and network accessibility indicate this would be a practical exploit for an attacker with agent-level access.

Remediation

Upgrade Nezha Monitoring to version 2.0.12 or later. This patch introduces proper authorization checks to ensure agents can only submit results for services they are explicitly authorized to monitor. Organizations should audit agent credential distribution and revoke any keys that may have been exposed. Review monitoring result histories for suspicious or anomalous data patterns that might indicate prior exploitation.

Patch guidance

Apply the security update to version 2.0.12 immediately. Verify the update through official Nezha project channels. Before updating, back up your monitoring configuration and historical data. Test the patched version in a non-production environment to confirm compatibility with your deployment. After patching, restart all agent instances to ensure they operate with the updated authorization logic.

Detection guidance

Monitor agent submission patterns for anomalies: agents reporting results for services outside their typical scope, sudden changes in result data from specific agents, or agents submitting results for services owned by different users. Audit agent credential logs for unauthorized key generation or distribution. Review service-result timestamps and values for inconsistencies or values that conflict with client-side agent reports. Implement access controls on agent credential management to prevent unauthorized key creation.

Why prioritize this

Although not yet on the CISA Known Exploited Vulnerabilities list, this vulnerability merits priority due to its direct impact on monitoring integrity and its exploitation simplicity once agent credentials are compromised. The HIGH CVSS score (7.1) reflects the integrity impact and availability implications. Organizations with distributed monitoring architectures or multiple teams sharing Nezha instances should prioritize patching to prevent data manipulation and operational confusion.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) is driven by high integrity impact (I:H) reflecting the ability to forge monitoring results, combined with low availability impact (A:L) from potential service disruption. The vulnerability requires authentication (PR:L) but is network-accessible with low complexity, making it practical to exploit. The lack of scope change (S:U) limits blast radius to the affected Nezha instance itself, preventing lateral movement, but the core monitoring function is compromised.

Frequently asked questions