CVE-2026-126307: Nezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation Flaws
Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to login-body capture through Dashboard hostname claims?
Deployments with undeclared Dashboard hostnames are exposed. An attacker can claim such a hostname and capture login request bodies.
Does exploitation always require an authenticated account?
No. The affected features can be abused by members or unauthenticated attackers, depending on the flaw. The description specifically identifies unauthenticated attackers among the potential threat actors.
What impact can occur beyond hostname takeover?
Attackers may hijack DDNS profiles, create executable cron schedules without exec scope, and exhaust memory through buffered NAT requests. These issues affect authorization, tenant isolation, and resource availability.
What version addresses the reported issues?
The vulnerabilities affect Nezha Dashboard versions before 2.6.0. Upgrading to 2.6.0 or later removes the stated affected-version condition.