Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Nezha (github.com/nezhahq/nezha) versions 0.20.0 to before 2.0.10 let an authenticated user with a DDNS webhook profile make the dashboard host send arbitrary HTTP requests to loopback or internal services. The response is not returned to the attacker, so this is blind SSRF. Upgrade to 2.0.10 or later. No fixed version is listed for github.com/naiba/nezha.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.4 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0022, the 12th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:06 UTC First seen by agentprime
- 31 Oct 2026, 15:06 UTC Confirmed by OSV