GO-2026-5119
Nezha's authenticated agents can forge service-monitor results for other users' services in github.com/nezhahq/nezha
Quick fix
GO-2026-5119 — github.com/nezhahq/nezha: upgrade to the fixed version with the command below.
go get github.com/nezhahq/nezha@v1.14.15-0.20260521020202-02129f16fb15Details
Nezha accepts service-monitor TaskResult messages from an authenticated agent based only on whether the reported service ID exists. The dashboard authenticates the agent and derives the reporter server ID from the gRPC stream, but the service-monitor result worker does not verify that the reporter server was selected for that service, belongs to the service owner, or was actually assigned that monitoring task.
A low-privilege user with a valid agent secret and one registered agent can submit forged monitoring results for another user's service ID. This allows cross-tenant corruption of service-monitor history and state, and can influence victim-owned service notifications.
Are you affected?
Enter the version of the package you're using.
Affected packages
0.20.0 No fixed version published yet for github.com/naiba/nezha (go modules). Pin to a known-safe version or switch to an alternative.
1.0.0 Fixed in: 1.14.15-0.20260521020202-02129f16fb15 go get github.com/nezhahq/nezha@v1.14.15-0.20260521020202-02129f16fb15