{"action":"Upgrade github.com/nezhahq/nezha to 2.1.0 or later.","affected":[{"fixed":"2.1.0","introduced":"2.0.14"}],"component":"github.com/nezhahq/nezha","cve_ids":["CVE-2026-53520"],"ecosystem":"Go","epss":0.00339,"exploited":false,"fixed_versions":["2.1.0"],"ghsa_id":"GHSA-x6fg-52vr-hj4w","id":"tcs_01M5KFRPSZZ2V1S2E0CXG6AW8Q","modified_at":"2026-07-07T16:11:11.340439685Z","published_at":"2026-06-26T23:00:14Z","references":["https://osv.dev/vulnerability/GHSA-x6fg-52vr-hj4w","https://github.com/nezhahq/nezha/security/advisories/GHSA-x6fg-52vr-hj4w","https://nvd.nist.gov/vuln/detail/CVE-2026-53520","https://github.com/nezhahq/nezha"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-x6fg-52vr-hj4w","url":"https://osv.dev/vulnerability/GHSA-x6fg-52vr-hj4w"}],"summary":"Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing"}