CVE-2026-46716: Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

Synopsis

A cross-tenant remote code execution vulnerability exists in Nezha Monitoring, a self-hostable server and website monitoring tool. The flaw is reachable over the network by any authenticated low-privilege user (RoleMember) without requiring admin rights or any victim interaction. Successful exploitation lets the attacker run arbitrary shell commands on every connected server across all tenants in the installation, including servers owned by other users and administrators, and exfiltrate the command output to an attacker-controlled webhook. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint (POST /api/v1/cron) is exposed over the network, so an attacker must be able to reach the Nezha dashboard service from a network-accessible path.

• AuthenticationRequired

  A valid low-privilege RoleMember account is sufficient; no administrative or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No victim action is needed; the scheduler automatically pushes the attacker's command to every connected server at each cron tick without any user involvement.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker simply creates a cron task with CronCoverAll and an arbitrary command, with no race condition or special environmental state required.

Blast Radius

• Attacker executes arbitrary shell commands on every agent-connected server in the installation, including servers belonging to other tenants and administrators.
• Full confidentiality loss: the attacker reads any file, environment variable, secret, or credential accessible to the agent process on each target server.
• Full integrity loss: the attacker modifies, deletes, or plants files and processes on every affected server across all tenants.
• Command output is exfiltrated to an attacker-controlled webhook via the attacker's own NotificationGroup, enabling persistent data harvesting with no direct network connection needed back to the victim servers.