CVE-2026-62283 nezhahq CVE debrief

Who should care

Administrators and users of Nezha Monitoring versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 should be aware of this vulnerability and take necessary actions to protect their systems. This includes reviewing and applying patches, restricting RoleMember privileges, and enhancing monitoring and authentication measures. Additionally, operators, platform administrators, vulnerability management teams, and security teams should assess their exposure and implement compensating controls as needed.

Technical summary

Nezha Monitoring, a self-hostable, lightweight tool for monitoring servers and websites, has a vulnerability in versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. The issue arises from the lack of binding between stream identifiers created by CreateStream in service/rpc/io_stream.go and their creating user. This allows an authenticated RoleMember who obtains a live stream UUID to attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. The vulnerability is addressed in version 2.0.10.

Defensive priority

Authenticated users with RoleMember privileges could potentially attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands due to insufficient stream identifier binding.

Recommended defensive actions

• Review and apply the vendor's patch in version 2.0.10
• Restrict RoleMember privileges to minimize potential impact
• Monitor logs and telemetry for potential exploitation attempts
• Implement additional authentication and authorization checks for stream identifiers
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. An authenticated RoleMember can attach to another user's terminal or file-manager session using a live stream UUID obtained from logs, browser history, referer data, or telemetry. The issue is fixed in version 2.0.10.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.