Loading story…
A critical authorization flaw in Nezha Monitoring allowed any authenticated user with the RoleMember role to execute arbitrary shell commands across all connected servers, including systems belonging to other tenants. The issue, tracked as CVE-2026-46716, affected versions 1.4.0 through before 2.0.8 and stemmed from the POST /api/v1/cron route being protected by a generic authentication check rather than an admin-only control. By creating or modifying a cron task with Cover=CronCoverAll, an empty Servers list, and an attacker-controlled command, a member could cause the dashboard scheduler to distribute that command to every server in the shared global map.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-46716 was reported as affecting Nezha Monitoring versions 1.4.0 through before 2.0.8, allowing a RoleMember to schedule commands that execute on servers belonging to other tenants. The reference states the vulnerability was fixed in Nezha Monitoring version 2.0.8.
A GitHub security advisory disclosed a critical authorization flaw in the Nezha dashboard that lets any authenticated RoleMember create or modify cron tasks and execute shell commands across every connected server, including other tenants' systems. The advisory states the issue affects master at commit 50dc8e660326b9f22990898142c58b7a5312b42a and earlier, and also notes a related plaintext dashboard-to-agent gRPC weakness in nezhahq/agent.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical remote code execution** issue in the *n8n* open-source workflow automation platform, tracked as **CVE-2026-25049** (also published as **GHSA-6cqr-8cfr-67f8**), allows an **authenticated** user with permission to create or modify workflows to escape n8n’s expression sandbox and execute arbitrary system commands on the underlying host. The flaw stems from **insufficient input sanitization/weak sandboxing** in n8n’s expression evaluation (server-side JavaScript) and was identified during follow-up analysis after an earlier critical n8n vulnerability (**CVE-2025-68613**) was patched; researchers report the new issue effectively **bypasses prior mitigations**. Reporting indicates exploitation can lead to **full compromise** of the n8n instance, including access to the filesystem and the ability to **steal stored credentials and secrets** (e.g., API keys, OAuth tokens) and sensitive configuration, with potential for **pivoting** into connected internal services and cloud accounts in multi-tenant deployments. Public reporting also notes **public exploits** are available. n8n maintainers state the issue is patched, and affected organizations should upgrade to fixed releases (**1.123.17** and **2.5.2**), as versions **prior to 1.123.17 and 2.5.2** are impacted.
Jun 29, 2026
A chain of vulnerabilities in **Nagios XI 5.5.10** allowed a remote attacker to gain a **root shell** by combining a reflected cross-site scripting flaw, an authenticated remote code execution bug, and a local privilege escalation issue. The attack began with a malicious URL targeting the `xiwindow` parameter; if an authenticated Nagios XI user with autodiscovery job creation privileges visited the link, the attacker could execute commands as `apache:nagios` through command injection in autodiscovery job handling via the `system_dns` parameter. The final step abused the root-runnable `repair_databases.sh` script, which evaluated PHP-derived output from a writable configuration file, enabling escalation from the web server context to full root access. The issues were assigned **`CVE-2019-9164`**, **`CVE-2019-9166`**, and **`CVE-2019-9167`**, and Nagios released **Nagios XI 5.5.11** to address the initial reported flaw as part of its security disclosures.
Jul 24, 2026
Several server and developer administration tools have disclosed severe code-execution vulnerabilities affecting exposed management functionality. **Termix** reported an authenticated OS command injection in `GET /ssh/file_manager/ssh/resolvePath`, where double-quoted user input allowed shell substitution via ``$(...)`` and backticks, enabling arbitrary commands on the connected remote host under the active SSH account. A separate **Termix** issue, tracked as `CVE-2026-45746`, affected versions prior to **2.3.2** and allowed attackers to tamper with a client-controlled `sessionId` to access other users' active File Manager SSH sessions, potentially leading to unauthorized file operations and remote code execution on another user's VPS. Other disclosures showed similar high-impact flaws in JavaScript-based backends. **DbGate** fixed an RCE in **v7.1.9** after researchers found that `POST /runners/start` and `POST /runners/load-reader` concatenated attacker-controlled values into generated JavaScript executed by a forked Node.js process; in anonymous-auth deployments, the issue could permit **unauthenticated RCE**. **BrowserStack Runner** through **0.9.5** was assigned `CVE-2026-49143` for an unauthenticated RCE in the `/_log` handler, where crafted JSON passed through `vm.runInNewContext()` and `eval()` allowed attackers to escape the sandbox and invoke `child_process` on reachable runner instances.
Jun 29, 2026