Task Type Validation Bypass in Nezha Dashboard by Nezha

CVE-2026-101086

What is CVE-2026-101086?

Nezha Dashboard versions before 2.3.5 exhibit a vulnerability that fails to adequately restrict service monitor task types to only allowed probe types. This flaw enables authenticated users with the nezha:service:write scope to exploit the service API, allowing them to submit privileged task types. Attackers can potentially execute commands or alter Agent configurations within their access rights by leveraging the shared protobuf Task.Type namespace between service monitors and privileged operations. This vulnerability necessitates immediate attention to prevent unauthorized access and actions.

References