CVE-2026-48119: Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services

Synopsis

This is an authenticated data-tampering vulnerability in Nezha Monitoring, a self-hostable server and website monitoring tool. An attacker with any valid agent credential can send forged service-monitor results that overwrite or corrupt monitoring data belonging to other users' services; no elevated privileges are needed beyond a basic authenticated agent account. Successful exploitation lets an attacker manipulate monitoring outcomes, causing false health reports, suppressed alerts, or degraded availability readings for services they do not own. A patched release (version 2.0.12) exists upstream; a patched-image rebuild is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Nezha Monitoring service over the network to submit forged agent reports.

• AuthenticationRequired

  A low-privilege authenticated agent account is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  No action from another user or administrator is required; the attacker submits forged results directly to the service.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions or special environmental setup.

Blast Radius

• An attacker submits fabricated health or latency results for services they do not own, replacing legitimate monitoring data with attacker-controlled values.
• False results suppress alerts or trigger false alarms for other users' services, masking real outages or manufacturing phantom incidents.
• Persistent injection of forged data degrades the reliability of availability records, corrupting historical uptime metrics and SLA reporting.
• Downstream automated responses (such as on-call triggers or auto-scaling rules) that rely on monitoring data can be manipulated into taking incorrect actions.