HIGHCVSS v3.1 7.5Vulnerability
CVE-2026-126307
Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00601
- Cvss severity
- HIGH
- Cvss score
- 7.5
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 7.5
- Cvss version
- 3.1
- Cve id
- CVE-2026-126307
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Published at
- 2026-11-13T10:17:36.143
- Last modified
- 2026-11-13T21:17:41.177
- Epss percentile
- 0.4933
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph