https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:44:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-327251 EUVD-2026-327251 https://cve.radiocsirt.org/vuln/euvd-2026-327251 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53520 <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0.</p> <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53520 https://cve.radiocsirt.org/vuln/ghsa-x6fg-52vr-hj4w <p><strong>Affected:</strong> Go: github.com/nezhahq/nezha</p> <p>### Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose `domain` is equal to the dashboard&#39;s own HTTP Host (for example, `dashboard.example:8008`). The dashboard&#39;s top-level HTTP/gRPC multiplexer checks `NATShared.GetNATConfigByDomain(r.Host)` before dispatching requests to the dashboard API, frontend, or gRPC handler, so a member-controlled NAT profile for the dashboard Host takes precedence over the real dashboard.</p> <p>A disabled claimed NAT profile blocks matching dashboard requests before they reach the dashboard handler. An enabled claimed NAT profile routes matching requests into `ServeNAT`, which sends a NAT task to the member&#39;s selected agent and wraps the original HTTP request into the NAT IO stream. This allows a low-privileged dashboard user to take over routing for a global host name that should be reserved for the dashboard operator.</p> <p>Tested locally against commit `8b5e382fe217107c7b777ea9c6b4bc3d2e156202` of `github.com/nezhahq/nezha`.</p> <p>### Details The NAT management API is exposed to any authenticated user, not just administrators: `auth.POST(&#34;/nat&#34;, commonHandler(createNAT))` and `auth.PATCH(&#34;/nat/:id&#34;, commonHandler(updateNAT))` are registered in `cmd/dashboard/controller/controller.go:147-150`.</p> <p>`createNAT` accepts the request body into `model.NATForm`, verifies only that the selected server exists and `server.HasPermission(c)` succeeds, then stores the caller-controlled `nf.Domain` directly into `n.Domain` and…</p> <p><strong>Affected:</strong> Go: github.com/nezhahq/nezha</p> <p>### Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose `domain` is equal to the dashboard&#39;s own HTTP Host (for example, `dashboard.example:8008`). The dashboard&#39;s top-level HTTP/gRPC multiplexer checks `NATShared.GetNATConfigByDomain(r.Host)` before dispatching requests to the dashboard API, frontend, or gRPC handler, so a member-controlled NAT profile for the dashboard Host takes precedence over the real dashboard.</p> <p>A disabled claimed NAT profile blocks matching dashboard requests before they reach the dashboard handler. An enabled claimed NAT profile routes matching requests into `ServeNAT`, which sends a NAT task to the member&#39;s selected agent and wraps the original HTTP request into the NAT IO stream. This allows a low-privileged dashboard user to take over routing for a global host name that should be reserved for the dashboard operator.</p> <p>Tested locally against commit `8b5e382fe217107c7b777ea9c6b4bc3d2e156202` of `github.com/nezhahq/nezha`.</p> <p>### Details The NAT management API is exposed to any authenticated user, not just administrators: `auth.POST(&#34;/nat&#34;, commonHandler(createNAT))` and `auth.PATCH(&#34;/nat/:id&#34;, commonHandler(updateNAT))` are registered in `cmd/dashboard/controller/controller.go:147-150`.</p> <p>`createNAT` accepts the request body into `model.NATForm`, verifies only that the selected server exists and `server.HasPermission(c)` succeeds, then stores the caller-controlled `nf.Domain` directly into `n.Domain` and…</p> https://cve.radiocsirt.org/vuln/ghsa-x6fg-52vr-hj4w