A privileged RoleMember user can create a scheduled cron task that runs an arbitrary shell command on every server managed by the system, regardless of tenant ownership. The cron task can be configured with no server filter, so the command is dispatched to all servers, including those belonging to other tenants. The resulting command execution grants the attacker full control over every affected host, allowing data exfiltration, persistence, and lateral movement.

Nezha Monitoring from nezhahq. Versions from 1.4.0 through 2.0.7 are vulnerable; the issue was fixed in version 2.0.8.

The CVSS score of 9.9 signals a critical severity. EPSS is below 1 %, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a REST API call to POST /api/v1/cron, requiring only that the attacker have RoleMember permissions. Once the attacker creates the cron entry, the scheduler automatically pushes the command to all servers and returns the output to an attacker‑controlled webhook, completing the exploitation chain.