CVE-2026-101086: Improper Privilege Management in nezhahq nezha
Nezha Dashboard versions before 2.3.5 contain an improper privilege management vulnerability that allows authenticated users with the nezha:service:write scope to submit privileged task types via the service API. This occurs because the software fails to restrict service monitor task types to supported probe types, enabling abuse of the shared protobuf Task.Type namespace. Exploiting this flaw, attackers can deliver command execution or Agent configuration tasks within their authorization scope.
AI Analysis
Technical Summary
CVE-2026-101086 affects Nezha Dashboard versions prior to 2.3.5. The vulnerability arises from improper privilege management where the service monitor task types are not restricted to supported probe types. Authenticated users with the nezha:service:write scope can submit privileged task types through the service API by exploiting the shared protobuf Task.Type namespace between service monitors and privileged operations. This allows attackers to execute commands or modify Agent configurations on Agents they are authorized to access.
Potential Impact
An attacker with authenticated access and the nezha:service:write scope can escalate privileges to perform command execution or reconfigure Agents within their authorization scope. This can lead to unauthorized control over Agent operations, potentially compromising system integrity and availability. The CVSS 4.0 score of 7.1 indicates a high severity vulnerability with network attack vector, low attack complexity, and no user interaction required.
Mitigation Recommendations
A fix is available in Nezha Dashboard version 2.3.5. Users should upgrade to version 2.3.5 or later to remediate this vulnerability. No additional mitigation guidance is provided or required beyond applying the official fix.
CVE-2026-101086: Improper Privilege Management in nezhahq nezha
Description
Nezha Dashboard versions before 2.3.5 contain an improper privilege management vulnerability that allows authenticated users with the nezha:service:write scope to submit privileged task types via the service API. This occurs because the software fails to restrict service monitor task types to supported probe types, enabling abuse of the shared protobuf Task.Type namespace. Exploiting this flaw, attackers can deliver command execution or Agent configuration tasks within their authorization scope.
CVSS v4.0
Score 7.1high
Affected software
nezhahq
nezha
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-101086 affects Nezha Dashboard versions prior to 2.3.5. The vulnerability arises from improper privilege management where the service monitor task types are not restricted to supported probe types. Authenticated users with the nezha:service:write scope can submit privileged task types through the service API by exploiting the shared protobuf Task.Type namespace between service monitors and privileged operations. This allows attackers to execute commands or modify Agent configurations on Agents they are authorized to access.
Potential Impact
An attacker with authenticated access and the nezha:service:write scope can escalate privileges to perform command execution or reconfigure Agents within their authorization scope. This can lead to unauthorized control over Agent operations, potentially compromising system integrity and availability. The CVSS 4.0 score of 7.1 indicates a high severity vulnerability with network attack vector, low attack complexity, and no user interaction required.
Mitigation Recommendations
A fix is available in Nezha Dashboard version 2.3.5. Users should upgrade to version 2.3.5 or later to remediate this vulnerability. No additional mitigation guidance is provided or required beyond applying the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-27T20:29:07.432Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab98494f7a7c541067b976c
Added to database: 09/27/2026, 21:03:16 UTC
Last enriched: 09/27/2026, 21:17:46 UTC
Last updated: 09/28/2026, 00:46:22 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.