CVE-2026-62283

Received Received - Intake

Stored Session Hijacking in Nezha Monitoring Tool

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user, and `GET /ws/terminal/:id` and `GET /ws/file/:id` only check whether the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer data, or telemetry can attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. This issue is fixed in version 2.0.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-62283

EUVD

EUVD-2026-64139

Affected Vendors & Products

Vendor	Product	Version / Range
nezha_monitoring	nezha	From 1.14.13 (inc) to 1.14.14 (inc)
nezha_monitoring	nezha	From 2.0.0 (inc) to 2.0.9 (inc)
nezha_monitoring	nezha	2.0.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Nezha Monitoring versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 have a flaw where stream identifiers created during terminal or file manager sessions are not properly bound to the user who created them. This allows an authenticated user with a valid stream UUID to access another user's active terminal or file session by exploiting endpoints like GET /ws/terminal/:id or GET /ws/file/:id.

Impact Analysis

An attacker with access to a stream UUID could attach to another user's terminal or file manager session, potentially reading sensitive files, executing arbitrary shell commands on the target server, or performing unauthorized actions. This requires only an authenticated RoleMember account and a valid UUID.

Mitigation Strategies

Immediately upgrade Nezha to version 2.0.10 or later to address the stream identifier binding issue. Review and restrict access to logs, browser history, and telemetry data that may expose stream UUIDs. Ensure all authenticated users have the minimum required privileges.

Hi! I’m here to help you understand CVE-2026-62283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70