CVE-2026-62283: Nezha Monitoring: cross-tenant terminal and file-manager session hijack via unowned WebSocket stream UUID
CVE-2026-62283 affects Nezha Monitoring from 1.14.13 up to and including 1.14.14, and from 2.0.0 up to 2.0.9. Stream identifiers are not bound to the user who created them, so an authenticated member who learns a live stream UUID may attach to another user's terminal or file-manager session. The issue is fixed in 2.0.10, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-62283 is an authorization flaw (CWE-639, insecure direct object reference) in Nezha Monitoring. Stream identifiers created for terminal and file-manager sessions are not bound to the user who created them, and the WebSocket endpoints only check that the identifier exists. Details are published in the GitHub security advisory and the NVD entry.
Impact
- According to the description, an authenticated member can attach to a terminal or file-manager session that belongs to another user.
- The description states this can allow reading and writing files on the target server and running shell commands.
- The CVSS score is 9.9, and the vector records high confidentiality, integrity and availability impact.
Affected products and versions
- Product: Nezhahq Nezha.
- Affected range: from 1.14.13 up to and including 1.14.14.
- Affected range: from 2.0.0 up to and including 2.0.9.
- The fix is in 2.0.10. The record's fixes list is empty, so no separate fixed-version entry is provided.
Exploitation status
The record shows the vulnerability is not listed in the CISA KEV catalog. No active exploitation or exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00551 with a percentile of 0.45301, dated 2026-10-23. The SSVC record lists exploitation as none and automatable as no.
Remediation and mitigation
- Upgrade to 2.0.10, the version named in the description as the fix.
- The record does not show a fix for the earlier affected range from 1.14.13 up to and including 1.14.14. Treat that range as affected until the vendor confirms otherwise.
- Review which accounts hold member roles and limit terminal and file-manager access to users who need it.
- Treat stream identifiers as sensitive. Keep them out of logs, referer data and telemetry where possible.
- Restrict network access to the management interface where feasible.
Detection guidance
- Review application and web server logs for WebSocket requests to terminal and file stream endpoints, where the account making the request differs from the session owner, if the application records that information.
- Look for terminal or file-manager activity outside normal administrator work.
- Check whether stream identifiers appear in access logs, proxy logs or monitoring data that many people can read.
Limitations of the available information
- The record does not state whether a separate fix exists for the earlier affected range.
- The sources consulted do not confirm exploit availability or in-the-wild activity beyond the KEV status.
- The record gives no technical reproduction details, and this analysis does not provide any.
- How a stream UUID would be obtained in a real environment is described only in general terms in the record.
Frequently asked questions
Is CVE-2026-62283 being actively exploited?
The record shows the vulnerability is not listed in the CISA KEV catalog. No active or in-the-wild exploitation appears in the sources consulted.
Which version fixes this issue?
The description and the referenced advisory identify 2.0.10 as the fixed version. The record does not show a fix for the earlier affected range from 1.14.13 up to and including 1.14.14.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.