As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-114442: Apache HertzBeat: incomplete XPath expression validation in aliasFields
Apache HertzBeat versions 1.7.1 through 1.9.1 contain incomplete XPath expression validation in the HTTP collector XML parsing path, allowing authenticated users with monitor template creation permissions to supply malicious XPath expressions. The vulnerability has low severity and affects multiple versions of the monitoring platform.
Why it matters: Organizations deploying HertzBeat should update to a patched version if they allow authenticated users to create monitor templates, as the flaw could enable expression injection attacks.
- Source published
- First seen by Cybersecurity Tracker