Cross-Site Request Forgery in Nezha Monitoring by Nezha Tech

CVE-2026-53521

What is CVE-2026-53521?

An improper input validation vulnerability exists in Nezha Monitoring versions prior to 2.1.0. Specifically, the PATCH /server/{id} endpoint can accept and store non-existent DDNS profile IDs for user servers. This flaw allows an attacker to exploit the system by creating a DDNS profile with one of those stored IDs. If successful, the DDNS worker improperly resolves the stored ID and uses the created profile's configuration to execute unauthorized updates in the context of the attacker's server, potentially compromising data integrity and leading to other security risks. The issue has been remedied in version 2.1.0.

References