PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-62283 nezhahq CVE debrief

Nezha Monitoring, a self-hostable and lightweight tool for monitoring servers and websites, has a critical vulnerability in versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. The issue arises from insufficient binding of stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user. This allows an authenticated RoleMember to potentially attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands if they obtain a live stream UUID from logs, browser history, referer data, or telemetry. The vulnerability is addressed in version 2.0.10, emphasizing the need for immediate patching and enhanced monitoring.

Vendor
nezhahq
Product
nezha
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-21
Original CVE updated
2026-08-21
Advisory published
2026-08-21
Advisory updated
2026-08-21

Who should care

Administrators and users of Nezha Monitoring versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 should be aware of this vulnerability and take necessary actions to protect their systems. This includes reviewing and applying patches, restricting RoleMember privileges, and enhancing monitoring and authentication measures. Additionally, operators, platform administrators, vulnerability management teams, and security teams should assess their exposure and implement compensating controls as needed.

Technical summary

Nezha Monitoring, a self-hostable, lightweight tool for monitoring servers and websites, has a vulnerability in versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. The issue arises from the lack of binding between stream identifiers created by CreateStream in service/rpc/io_stream.go and their creating user. This allows an authenticated RoleMember who obtains a live stream UUID to attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. The vulnerability is addressed in version 2.0.10.

Defensive priority

Authenticated users with RoleMember privileges could potentially attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands due to insufficient stream identifier binding.

Recommended defensive actions

  • Review and apply the vendor's patch in version 2.0.10
  • Restrict RoleMember privileges to minimize potential impact
  • Monitor logs and telemetry for potential exploitation attempts
  • Implement additional authentication and authorization checks for stream identifiers
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. An authenticated RoleMember can attach to another user's terminal or file-manager session using a live stream UUID obtained from logs, browser history, referer data, or telemetry. The issue is fixed in version 2.0.10.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-21T21:17:01.183Z and has not been modified since then.