CVE-2026-48119

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 0.20.0 through 2.0.11

Description Authenticated agents can forge service-monitor results for services belonging to other users. The system accepts TaskResult messages from an authenticated agent based solely on whether the reported service ID exists, without verifying if the reporter server was assigned to that service, belongs to the service owner, or was authorized to perform the monitoring task.

A low-privilege user with a valid agent secret and one registered agent can submit forged monitoring results for another user's service ID. This leads to cross-tenant corruption of service-monitor history and current state. Additionally, it can trigger victim-owned service notifications containing attacker-controlled text via the data variable in the TaskResult message.

Technical details involve the service-monitor worker in service/singleton/servicesentinel.go which fails to validate the Reporter against the service coverage and ownership, unlike the outbound dispatch logic.

Recommendations Update to version 2.0.12.