PatchSiren cyber security CVE debrief
CVE-2026-62283 nezhahq CVE debrief
Nezha Monitoring, a self-hostable and lightweight tool for monitoring servers and websites, has a critical vulnerability in versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. The issue arises from insufficient binding of stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user. This allows an authenticated RoleMember to potentially attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands if they obtain a live stream UUID from logs, browser history, referer data, or telemetry. The vulnerability is addressed in version 2.0.10, emphasizing the need for immediate patching and enhanced monitoring.
- Vendor
- nezhahq
- Product
- nezha
- CVSS
- CRITICAL 9.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-21
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-21
- Advisory updated
- 2026-08-21
Who should care
Administrators and users of Nezha Monitoring versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 should be aware of this vulnerability and take necessary actions to protect their systems. This includes reviewing and applying patches, restricting RoleMember privileges, and enhancing monitoring and authentication measures. Additionally, operators, platform administrators, vulnerability management teams, and security teams should assess their exposure and implement compensating controls as needed.
Technical summary
Nezha Monitoring, a self-hostable, lightweight tool for monitoring servers and websites, has a vulnerability in versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. The issue arises from the lack of binding between stream identifiers created by CreateStream in service/rpc/io_stream.go and their creating user. This allows an authenticated RoleMember who obtains a live stream UUID to attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. The vulnerability is addressed in version 2.0.10.
Defensive priority
Authenticated users with RoleMember privileges could potentially attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands due to insufficient stream identifier binding.
Recommended defensive actions
- Review and apply the vendor's patch in version 2.0.10
- Restrict RoleMember privileges to minimize potential impact
- Monitor logs and telemetry for potential exploitation attempts
- Implement additional authentication and authorization checks for stream identifiers
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
Evidence notes
The CVE record and NVD entry provide details on the vulnerability in Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. An authenticated RoleMember can attach to another user's terminal or file-manager session using a live stream UUID obtained from logs, browser history, referer data, or telemetry. The issue is fixed in version 2.0.10.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-21T21:17:01.183Z and has not been modified since then.