GO-2026-5119

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5119

Import Source

https://vuln.go.dev/ID/GO-2026-5119.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5119

Aliases

Published

2026-08-11T20:19:48Z

Modified

2026-08-11T20:45:07Z

Summary

Nezha's authenticated agents can forge service-monitor results for other users' services in github.com/nezhahq/nezha

Details

Nezha accepts service-monitor TaskResult messages from an authenticated agent based only on whether the reported service ID exists. The dashboard authenticates the agent and derives the reporter server ID from the gRPC stream, but the service-monitor result worker does not verify that the reporter server was selected for that service, belongs to the service owner, or was actually assigned that monitoring task.

A low-privilege user with a valid agent secret and one registered agent can submit forged monitoring results for another user's service ID. This allows cross-tenant corruption of service-monitor history and state, and can influence victim-owned service notifications.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5119"
}

References

Affected packages

Go / github.com/naiba/nezha

Package

Name: github.com/naiba/nezha; View open source insights on deps.dev
Purl: pkg:golang/github.com/naiba/nezha

Affected ranges

Type: SEMVER
Events: Introduced

0.20.0

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5119.json"

Go / github.com/nezhahq/nezha

Package

Name: github.com/nezhahq/nezha; View open source insights on deps.dev
Purl: pkg:golang/github.com/nezhahq/nezha

Affected ranges

Type: SEMVER
Events: Introduced

1.0.0

Fixed

1.14.15-0.20260521020202-02129f16fb15

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/nezhahq/nezha/service/rpc"
        },
        {
            "path": "github.com/nezhahq/nezha/service/singleton"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5119.json"