CVE-2026-126307

Name of the Vulnerable Software and Affected Versions Nezha Dashboard versions prior to 2.6.0

Description Multiple issues involving authorization, tenant isolation, and resource exhaustion allow members or unauthenticated attackers to abuse several features. These include NAT, DDNS, OAuth, cron, and server transfer. Specifically, attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, and create executable schedules without exec scope. Additionally, memory exhaustion can be triggered via buffered NAT requests.

Recommendations Update Nezha Dashboard to version 2.6.0 or later.