CVE-2026-49396: Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents

Synopsis

This is a cross-site request forgery (CSRF) vulnerability in Nezha Monitoring, a self-hostable server and website monitoring tool. An unauthenticated remote attacker can craft a malicious GET request that, when loaded by a logged-in victim's browser, triggers stored cron commands to execute on the victim's connected agents. Successful exploitation lets an attacker tamper with scheduled tasks running on monitored servers and cause service disruption. A patched-image rebuild at version 2.0.14 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious GET request over the network, so the victim's browser must be able to reach the Nezha Monitoring interface.

• AuthenticationNot required

  No credentials are needed; the attacker crafts a link that leverages the victim's existing authenticated session.

• Victim interactionRequired

  The attack succeeds only if a logged-in Nezha Monitoring user clicks or loads the attacker-controlled link, making social engineering a necessary step.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim loads the request; no race conditions or special environmental factors are required.

Blast Radius

• Stored cron commands are executed on the victim's connected monitoring agents without the legitimate administrator's intent.
• An attacker modifies the scheduling or content of automated tasks running on monitored servers.
• Disruption of monitoring agents or the tasks they manage can degrade visibility into server and service health.