CVE-2026-46716 — Nezha 监控通过 Cron API 授权绕过实现跨租户 RCE

一个用于复现和检测 CVE-2026-46716 的实验室环境。该漏洞是 Nezha 监控中的一个严重漏洞：POST /api/v1/cron 端点缺少管理员权限检查，使 RoleMember 用户能够实现跨租户远程代码执行。

漏洞概述

字段	详情
CVE ID	CVE-2026-46716
GHSA	GHSA-99gv-2m7h-3hh9
CVSS	9.9（严重）— `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
受影响版本	nezhahq/nezha >= 1.4.0, < 1.14.15-0.20260517022419-d7526351cf97
已修复版本	v1.14.15-0.20260517022419-d7526351cf97（提交 d7526351cf97，2026-05-17）
CWE	CWE-862（缺少授权）、CWE-269（权限管理不当）、CWE-78（操作系统命令注入）

根本原因

Vulnerable path:
POST /api/v1/cron  →  commonHandler (JWT auth only, no role check)
  → CheckPermission(servers=[])
    → iterates empty list → returns true unconditionally
      → CronTrigger dispatches command to ALL servers via ServerShared map
        ❌ No admin check, no ownership validation → cross-tenant RCE

Patched path:
POST /api/v1/cron  →  commonHandler (same — HTTP 200 still returned for members)
  → CheckPermission(servers=[]) → true (unchanged)
    → CronTrigger: cronCanSendToServer(cr, s) checks cr.UserID == s.UserID
      ✅ Commands only dispatched to servers owned by the cron creator

攻击前提条件

#	条件	详情
1	受影响的 Nezha 版本	< 1.14.15-0.20260517022419
2

实验室架构

Host Machine
├── localhost:8008 ──→ Docker: nezha-vuln    (v1.14.14            ⚠ VULNERABLE)
└── localhost:8009 ──→ Docker: nezha-patched (commit d7526351cf97 ✓ PATCHED, built from source)

环境准备

工具	安装方式
Docker Desktop	docker.com
nuclei	`brew install nuclei`
curl、python3	macOS 预装

如何运行

步骤 1 — 搭建实验室环境

bash scripts/01-setup.sh

完成后：

══════════════════════════════════════════════════════
 Lab ready!
══════════════════════════════════════════════════════
 Vulnerable  (v1.14.14) : http://localhost:8008
 Patched     (latest) : http://localhost:8009
 Admin       : admin / admin
 Member      : member / Memberpass123!
══════════════════════════════════════════════════════

注意： 如果成员账户创建 API 与预期不符，请通过 Nezha UI 在 http://localhost:8008（设置 → 用户）手动创建。

步骤 2 — 触发 CVE

bash scripts/03-trigger-cve.sh

预期输出 — 存在漏洞的版本（v1.14.14）：

HTTP 200 — Cron created (id: 1)
⚠  RESULT: ADMIN CHECK BYPASSED — VULNERABLE

预期输出 — 已修复版本：

HTTP 403 — Access denied
✓  RESULT: Admin check enforced — PATCHED

步骤 3 — Nuclei 检测

# Vulnerable cluster → should produce a [critical] finding
nuclei -duc -t nuclei/CVE-2026-46716.yaml \
  -u http://localhost:8008 \
  -var username=admin \
  -var password=admin

# Patched cluster → should produce no findings
nuclei -duc -t nuclei/CVE-2026-46716.yaml \
  -u http://localhost:8009 \
  -var username=admin \
  -var password=admin

步骤 4 — 清理环境

bash scripts/99-teardown.sh

目录结构

nezha-cve-2026-46716-lab/
├── README.md
├── LAB_SETUP_GUIDE.md              # Lab setup guide (English)
├── VULNERABILITY_ANALYSIS.md       # Code-level vulnerability analysis (English)
├── NUCLEI_TEMPLATE_GUIDE.md        # Nuclei template design and test results (English)
├── docker-compose.yaml
│
├── REPORT/                         # Korean reports
│   ├── LAB_REPORT_KR.md
│   ├── Nuclei_Template_Report_KR.md
│   └── Vulnerability_Analysis_KR.md
│
├── nuclei/
│   └── CVE-2026-46716.yaml         # Nuclei detection template
│
└── scripts/
    ├── 01-setup.sh                 # Start containers, create member account
    ├── 03-trigger-cve.sh           # PoC: trigger auth bypass, verify result
    └── 99-teardown.sh              # Stop and remove all lab resources

Nuclei 模板检测逻辑

Step 1  POST /api/v1/login  (admin credentials)
        → authenticate and extract JWT token

Step 2  GET /api/v1/setting
        → version field matched against vulnerable range (1.4.x – 1.14.14)
        → match  →  FINDING: vulnerable version detected
        → no match (>= 1.14.15 or "debug")  →  no finding

存在漏洞的版本和已修复的版本在使用 servers:[], cover:1 调用 POST /api/v1/cron 时都会返回 HTTP 200 —— 因此无法进行行为检测。该补丁仅在 CronTrigger 执行时增加了所有权验证，而非在 API 层。需要管理员凭据，因为 GET /api/v1/setting 仅对 RoleAdmin 用户返回 version 字段。

参考资料

警告： 本实验室中的所有凭据均为仅供安全研究使用的伪造测试数据。切勿在生产环境中使用。

POC_CVE-2026-46716

最受欢迎