An authenticated user of the Nezha dashboard can create or modify a DDNS profile and specify any webhook URL, HTTP method, body, and headers. The dashboard sends these requests via an internal HTTP client that bypasses the SSRF protections applied to normal notification webhooks. This provides a blind SSRF and internal state‑changing request primitive that allows the attacker to cause the dashboard host to send requests to loopback or internal network services, but the response body is not returned to the attacker. The attack therefore enables internal service interaction but does not provide direct data exfiltration.

The vulnerability affects Nezha Monitoring from version 0.20.0 up to, but not including, 2.0.10. Versions 2.0.10 and later contain the patch that disables the unsafe webhook configuration pathway.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the near term, and the vulnerability is not listed in CISA KEV. However, the required attacker capability is simply an authenticated dashboard user with permission to configure DDNS profiles, which many users possess. If exploited, the attacker can perform internal network requests that may modify state or trigger side effects on internal services. Prompt patching is recommended to mitigate this risk.