CVE-2026-62283: Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET /ws/file/:id only check whether the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer data, or telemetry can attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. This issue is fixed in version 2.0.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nezha Monitoringto a version that resolves this vulnerability.Fixed in 2.0.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the RoleMember role can exploit it. They must obtain a live terminal or file-manager stream UUID belonging to another user, such as through logs, browser history, referer data, or telemetry.
What access does a successful attacker gain?
The attacker can attach to another user's terminal or file-manager session. This can allow reading and writing files on the target server and executing shell commands.
Which versions are affected and what version fixes the issue?
Affected versions are 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. The issue is fixed in version 2.0.10.
What can be done if upgrading is not immediately possible?
Limit RoleMember access to trusted users and prevent live stream UUIDs from being exposed through logs, browser history, referer data, or telemetry. Treat any potentially exposed live UUID as capable of granting access to the associated session.