CVE-2026-47120: Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)

Synopsis

A missing ownership check in Nezha Monitoring allows an authenticated low-privilege user (RoleMember) to trigger cron tasks belonging to other users via the AlertRule.FailTriggerTasks API endpoint. The vulnerability is reachable over the network and requires no victim interaction, only a valid low-privilege account. Successful exploitation lets the attacker execute arbitrary cron tasks owned by other users, enabling unauthorized task execution and limited disruption of monitored systems. A patched-image rebuild at version 2.0.8 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The AlertRule.FailTriggerTasks endpoint is exposed over the network, so the attacker must be able to reach the Nezha Monitoring service via HTTP/S.

• AuthenticationRequired

  A valid low-privilege account with the RoleMember role is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker sends the malicious API request directly; no action from another user is needed to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• The attacker fires cron tasks owned by any other user, executing whatever commands or scripts those tasks contain without the owner's consent.
• Unauthorized task execution can modify server state, alter monitored targets, or disrupt scheduled O&M operations (integrity impact is high).
• Repeated or bulk task firing can degrade service availability for legitimate users by exhausting task execution resources or interfering with monitoring schedules (availability impact is low).
• No confidential data is directly exposed through this vulnerability; the confidentiality impact is none.