CVE-2026-49396

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.0.0 through 2.0.13

Description A cross-site request forgery (CSRF) issue exists where a cross-site GET request can trigger stored cron commands on a victim's agents. The dashboard exposes a manual-trigger action via the authenticated endpoint "/api/v1/cron/:id/manual". Because this state-changing endpoint uses the GET method and lacks CSRF tokens, origin validation, or fetch-metadata guards, an attacker can force a logged-in user to execute an existing cron task by navigating their browser to the specific URL. This occurs because the nz-jwt cookie is configured with SameSite=Lax, which allows browsers to include the cookie during top-level cross-site GET navigations. The attacker must know or guess the numeric id of a cron task owned by the victim to trigger it.

Recommendations Update to version 2.0.14. As a temporary workaround, restrict access to the "/api/v1/cron/:id/manual" endpoint to minimize the risk of exploitation.