Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-53521Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

Medium 6.4

In plain English

A medium-severity incorrect authorization in nezha from nezhahq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.3%top 80.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server. This issue has been patched in version 2.1.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/nezhahq/nezha	2.1.0	GHSA-39g2-8x68-pmx8
Go	github.com/nezhahq/nezha	no fix listed	GO-2026-5826

Affected products (as reported)

Vendor	Product	Versions
nezhahq	nezha	>= 2.0.14, < 2.1.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

References

https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8 x_refsource_CONFIRM