Session Hijacking Vulnerability in Nezha Monitoring Tool

CVE-2026-62283

What is CVE-2026-62283?

Nezha Monitoring, a lightweight tool for monitoring servers and websites, is affected by a vulnerability where stream identifiers created by the CreateStream function are not properly bound to their creating users. This occurs in Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. As a result, an authenticated RoleMember can exploit this flaw by obtaining a live stream UUID from various sources such as logs, browser history, or telemetry. They can then attach to another user's terminal or file-manager session, allowing them to read and write files on the target server, as well as execute shell commands. This serious issue was addressed and fixed in version 2.0.10.

References