CVE-2026-46717: Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

Synopsis

This is a server-side request forgery (SSRF) vulnerability in Nezha Monitoring, a self-hostable server and website monitoring tool. Any authenticated user holding a low-privilege RoleMember account can send a crafted POST request to the notification API endpoint, causing the Nezha dashboard server to make an outbound HTTP request to an attacker-controlled URL and reflect the full response body back to the caller. Successful exploitation lets an attacker read responses from internal network resources that the Nezha host can reach, including cloud metadata services, internal APIs, and other services not exposed to the public internet. No patched version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Nezha dashboard's HTTP API over the network, as the CVSS vector specifies AV:N (network-accessible attack surface).

• AuthenticationRequired

  A valid low-privilege RoleMember account is sufficient; no administrative privileges are needed, but unauthenticated access alone does not trigger this path.

• Victim interactionNot required

  No interaction from another user or administrator is needed; the attacker sends the crafted request directly and the server acts on it immediately.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is straightforward and repeatable with no race conditions, special memory layout, or other environmental dependencies required.

Blast Radius

• Reads HTTP responses from internal network hosts and services that the Nezha dashboard server can reach, such as cloud instance metadata endpoints (e.g. 169.254.169.254) or internal microservices.
• Reads full, unsized response bodies from those internal targets, meaning credentials, tokens, and configuration data returned by internal services are exposed to the attacker.
• Allows internal network topology enumeration by probing arbitrary IP addresses and ports and observing whether responses are reflected or errors are returned.