CVE-2026-101086
Nezha Dashboard before 2.3.5 Task Type Validation Bypass
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 27, 2026
- Updated
- Sep 28, 2026
- Reserved
- Sep 27, 2026
Description
Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. Attackers can deliver command execution or Agent configuration tasks to Agents within their authorization scope by exploiting the shared protobuf Task.Type namespace between service monitors and privileged operations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
nezhanezhahq |
|
References
- GitHub Security Advisory (GHSA-grrw-fx36-fv32)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: Nezha Dashboard before 2.3.5 Task Type Validation Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.