CVE-2026-49397: Nezhahq Nezha

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14, private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data. This issue has been patched in version 2.0.14.

Affected products

• Nezhahq Nezha: from 2.0.0, before 2.0.14 (fixed in 2.0.14)

Published 2026-06-12. Last modified 2026-06-17.