CVE-2026-49397CWE-200CWE-285CWE-863

Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data

Medium · published June 12, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.0 to before version 2.0.14, private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data. This issue has been patched in version 2.0.14.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-285 · Improper Authorization; CWE-863 · Incorrect Authorization
Published
2026-06-12T21:03Z
EPSS history
Timeline
  • 12 JUN 21:03Z
    Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data
    cvelistv5