MEDIUM6.4Go
GHSA-6x26-5727-rrm9· CVE-2026-47268, GO-2026-5194Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host
Modified: 6/26/2026
package
Go/github.com/naiba/nezha
pkg:go/github.com/naiba/nezha
—Go
GO-2026-5119· CVE-2026-48119, GHSA-4g6j-g789-rghmNezha's authenticated agents can forge service-monitor results for other users' services in github.com/nezhahq/nezha
Modified: 8/11/2026
—Go
GO-2026-5194· CVE-2026-47268, GHSA-6x26-5727-rrm9Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host in github.com/nezhahq/nezha in github.com/naiba/nezha
Modified: 6/25/2026