Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
Priority MEDIUM 62CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed nezha (nezhahq): 2.1.0github.com/nezhahq/nezha (Go): 2.1.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nezhahq | nezha | 2.0.14 to before 2.1.0 | 2.1.0 | Patch available | CNA |
| — | github.com/nezhahq/nezha (Go) | 2.0.14 to before 2.1.0 | 2.1.0 | Patch available | GHSA-x6fg-52vr-hj4w |
- nezha Vendornezhahq Affected 2.0.14 to before 2.1.0 Fixed in 2.1.0 Patch available CNA
- github.com/nezhahq/nezha (Go) Vendor— Affected 2.0.14 to before 2.1.0 Fixed in 2.1.0 Patch available GHSA-x6fg-52vr-hj4w
Remediation
- Fix · CNA nezha (nezhahq) Fixed in 2.1.0
- Fix · GHSA-x6fg-52vr-hj4w github.com/nezhahq/nezha (Go) Fixed in 2.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53520
- 2026-10-03 Alias added: GHSA-x6fg-52vr-hj4w
References
More nezhahq vulnerabilities
- TI-2026-65123 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri CVSS 4.0CRITICAL 9.3
- TI-2026-34341 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CVSS 3.1CRITICAL 9.9
- TI-2026-34342 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification CVSS 3.1HIGH 7.7
- TI-2026-38597 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection CVSS 3.1MEDIUM 6.8
- TI-2026-75131 Memory exhaustion in Nezha file manager WebSocket endpoint CVSS 4.0HIGH 7.1
- TI-2026-75130 Nezha WebSocket transfer endpoint flaw enables denial of service CVSS 4.0HIGH 7.1
Sources
- CVE-2026-53520 · CVE Program
- CVE-2026-53520 · NVD
- FIRST EPSS
- GHSA-x6fg-52vr-hj4w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences