Authenticated users can claim the dashboard host through NAT, allowing them to preempt all routing on the monitoring dashboard. This flaw permits a user to take control over how traffic is directed within the dashboard, effectively overriding legitimate routing rules. The vulnerability is classified as a privilege escalation within the dashboard’s routing logic, meaning an attacker who authenticates can alter or seize control of dashboard traffic flow, potentially denying legitimate users access or redirecting data streams.

The issue affects the Nezha Monitoring product from nezhahq:nezha, specifically versions ranging from 2.0.14 up to but not including 2.1.0. No other vendor or product versions are listed as impacted.

The CVSS score of 6.5 indicates a medium‑to‑high risk, and the lack of an EPSS score makes the current exploitation probability unclear; however, because the attack requires authentication, an attacker must first compromise a user account. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers could use the flaw to reconfigure dashboard routing, potentially redirecting or blocking legitimate monitoring traffic, and effectively take over the dashboard environment.