PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53523 nezhahq CVE debrief

CVE-2026-53523 is a medium-severity vulnerability in Nezha Monitoring, a self-hostable, lightweight monitoring and O&M tool. Versions from 1.0.0 to before 2.2.0 are affected by a host header injection issue due to improper validation of the Host header in the getRedirectURL function. This vulnerability, with a CVSS score of 6.8, can be exploited through user interaction and requires no privileges. It has been patched in version 2.2.0.

Vendor
nezhahq
Product
nezha
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-15
Advisory published
2026-06-12
Advisory updated
2026-06-15

Who should care

Users of Nezha Monitoring versions 1.0.0 through 2.1.0 should update to version 2.2.0 or later to mitigate this vulnerability.

Technical summary

The getRedirectURL function in oauth2.go (lines 22-29) constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, without proper validation of the Host header. This allows for host header injection attacks.

Defensive priority

Medium

Recommended defensive actions

  • Update Nezha Monitoring to version 2.2.0 or later.
  • Review and validate user input, especially the Host header, to prevent similar vulnerabilities.

Evidence notes

CVE-2026-53523 has been patched in version 2.2.0. For more information, see [ref-4](https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53523 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53523

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53523 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53523

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.