Medium severity · published Jun 12, 2026
CVE-2026-53520
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
nezha · nezhahq
>= 2.0.14, < 2.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53520
github.com
https://github.com/nezhahq/nezha/security/advisories/GHSA-x6fg-52vr-hj4w
More from nezha
9.9
CVE-2026-62283
Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
9.9
CVE-2026-46716
Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
9.8
CVE-2026-101090
Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri
9.1
CVE-2026-53519
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
7.7
CVE-2026-46717
Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification