Apache HertzBeat, an open-source real-time monitoring system, has a critical vulnerability in version 1.8.0 that allows authenticated users to execute arbitrary operating system commands on the host server.
The issue lies in how HertzBeat handles monitoring template definitions. An authenticated user can send a PUT request to /api/apps/define/yml with a YAML body specifying protocol: script. The scriptCommand parameter in that YAML gets passed directly to ProcessBuilder as bash -c “
What makes this particularly dangerous is the default Docker deployment runs as root (uid=0). So an attacker who compromises any standard user account — or uses the default operator/hertzbeat credentials — can potentially take over the entire container. If the overwritten template has active monitoring instances, the commands execute within seconds automatically.
Apache Security has classified this as “not a vulnerability” per their security model, since it requires authentication. But in practice, any environment with shared access or compromised credentials is at risk. If you’re running HertzBeat 1.8.0, restrict access to the API immediately and monitor for unauthorized template modifications.
