CVE-2026-53519: Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

Synopsis

A path traversal vulnerability in Nezha Monitoring's dashboard handler allows an unauthenticated remote attacker to read arbitrary files from the server's working directory. The flaw stems from a prefix check using strings.HasPrefix rather than a proper path-segment comparison, so a crafted URL like /dashboard../data/config.yaml bypasses the guard and resolves to a file outside the intended admin-dist directory via path.Join normalization. Successful exploitation leaks sensitive files including jwt_secret_key from the config, enabling full authentication bypass and data tampering. A patched-image rebuild at version 2.0.13 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable dashboard handler is exposed over the network; an attacker must be able to reach the HTTP/HTTPS port of the Nezha Monitoring instance to send the crafted URL.

• AuthenticationNot required

  No credentials or session token are needed; the path traversal occurs inside the NoRoute handler before any authentication check is applied.

• Victim interactionNot required

  The attacker sends a direct HTTP request to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply crafts a URL with the /dashboard.. prefix and the target relative path, with no race conditions or environment-specific layout requirements.

Blast Radius

• Reads arbitrary files accessible to the Nezha Monitoring process, starting with data/config.yaml, which contains jwt_secret_key.
• With jwt_secret_key in hand, an attacker forges valid JWT tokens and gains full administrative access to the dashboard and its API.
• Authenticated API access allows an attacker to modify monitored host configurations, webhook targets, notification channels, and stored credentials for managed servers.
• Sensitive data for all monitored servers and websites managed through the Nezha instance is exposed to the attacker.