CVE-2026-101086: Nezha Dashboard before 2.3.5 Task Type Validation Bypass
Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. Attackers can deliver command execution or Agent configuration tasks to Agents within their authorization scope by exploiting the shared protobuf Task.Type namespace between service monitors and privileged operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nezha Dashboardto a version that resolves this vulnerability.Fixed in 2.3.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user needs the nezha:service:write scope. They can target only Agents that fall within their authorization scope.
What can an attacker do through the vulnerable service API?
They can submit privileged task types instead of supported service-monitor probe types. The described impact includes delivering command-execution tasks or Agent-configuration tasks to authorized Agents.
Are all Nezha Dashboard versions affected?
The issue affects Nezha Dashboard versions before 2.3.5. The provided data does not identify any configuration prerequisite beyond access to the service API and the required scope.