TI-2026-38595 Aliases CVE-2026-53521 GHSA-39g2-8x68-pmx8

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

MEDIUM 62CWE-863Published 2026-06-12 · Updated 2026-06-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server. This issue has been patched in version 2.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00274 19th percentileScored 2026-11-07

Fix Fixed nezha (nezhahq): 2.1.0github.com/nezhahq/nezha (Go): 2.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nezhahq	nezha	2.0.14 to before 2.1.0	2.1.0	Patch available	CNA
—	github.com/nezhahq/nezha (Go)	2.0.14 to before 2.1.0	2.1.0	Patch available	GHSA-39g2-8x68-pmx8

nezha Vendornezhahq Affected 2.0.14 to before 2.1.0 Fixed in 2.1.0 Patch available CNA
github.com/nezhahq/nezha (Go) Vendor— Affected 2.0.14 to before 2.1.0 Fixed in 2.1.0 Patch available GHSA-39g2-8x68-pmx8

Remediation

Fix · CNA nezha (nezhahq) Fixed in 2.1.0
Fix · GHSA-39g2-8x68-pmx8 github.com/nezhahq/nezha (Go) Fixed in 2.1.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-53521
2026-10-03 Alias added: GHSA-39g2-8x68-pmx8

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-53521

Other 2

TI-2026-65123 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri CVSS 4.0CRITICAL 9.3
TI-2026-34341 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CVSS 3.1CRITICAL 9.9
TI-2026-34342 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification CVSS 3.1HIGH 7.7
TI-2026-38597 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection CVSS 3.1MEDIUM 6.8
TI-2026-75131 Memory exhaustion in Nezha file manager WebSocket endpoint CVSS 4.0HIGH 7.1
TI-2026-75130 Nezha WebSocket transfer endpoint flaw enables denial of service CVSS 4.0HIGH 7.1

See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences