CVE-2026-62283: Nezha Monitoring Auth Bypass Vulnerability

CVE-2026-62283 Overview

CVE-2026-62283 is an authorization flaw in Nezha Monitoring, a self-hostable server and website monitoring tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 fail to bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their originating user. The endpoints GET /ws/terminal/:id and GET /ws/file/:id only validate that the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer headers, or telemetry can attach to another user's terminal or file-manager session. The issue is fixed in version 2.0.10 and tracked as [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Any authenticated low-privileged user who obtains a stream UUID can hijack another user's terminal session, execute shell commands on monitored servers, and read or write arbitrary files.

Affected Products

Nezha Monitoring versions 1.14.13 through 1.14.14
Nezha Monitoring versions 2.0.0 through 2.0.9
Fixed in Nezha Monitoring version 2.0.10

Discovery Timeline

2026-08-21 - CVE-2026-62283 published to the National Vulnerability Database
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-62283

Vulnerability Analysis

Nezha exposes WebSocket endpoints for interactive terminal access and file management to monitored servers. When a user initiates a session, the dashboard controller calls rpc.NezhaHandlerSingleton.CreateStream(streamId) and returns a UUID that the client uses to attach via GET /ws/terminal/:id or GET /ws/file/:id. The handler validates only the existence of the UUID and does not verify that the requesting user created the stream.

Any authenticated user with the RoleMember role can attach to a stream created by another user, including administrators. Once attached, the attacker inherits full read and write access to the target server's shell and filesystem. The stream UUID can leak through server access logs, browser history entries, HTTP Referer headers on outbound links, or third-party telemetry.

Root Cause

The CreateStream function in service/rpc/io_stream.go stored session identifiers without associating them with the creating user's ID. The controller handlers in cmd/dashboard/controller/terminal.go and cmd/dashboard/controller/fm.go therefore had no user context to enforce during attach. This is a classic Insecure Direct Object Reference where the object key acts as a bearer capability.

Attack Vector

Exploitation requires an authenticated Nezha account with RoleMember privileges and knowledge of a live stream UUID. The attacker issues a WebSocket upgrade request to /ws/terminal/:id or /ws/file/:id using the captured UUID. The scope change is significant because a low-privileged member can hijack an administrator's live terminal to run commands as the agent user on remote monitored hosts.

// Security patch: bind io_stream sessions to creator
// File: cmd/dashboard/controller/terminal.go and cmd/dashboard/controller/fm.go

// Before (vulnerable):
-	rpc.NezhaHandlerSingleton.CreateStream(streamId)

// After (fixed):
+	rpc.NezhaHandlerSingleton.CreateStream(streamId, getUid(c))

	terminalData, _ := json.Marshal(&model.TerminalTask{
		StreamID: streamId,
// Source: https://github.com/nezhahq/nezha/commit/6661d6a7fc1c269f55c7f4e775082ad23fbe0f54

Detection Methods for CVE-2026-62283

Indicators of Compromise

Multiple distinct source IP addresses or user-agent strings connecting to the same /ws/terminal/:id or /ws/file/:id UUID within a short interval.
Unexpected shell commands executed on monitored agents that do not match any administrator's activity log.
WebSocket upgrade requests to terminal or file-manager endpoints from user accounts that did not originate the session.

Detection Strategies

Parse Nezha dashboard access logs and correlate stream UUIDs against the authenticated user who created them via API audit records.
Alert on any WebSocket attach to /ws/terminal/:id or /ws/file/:id where the requesting user ID differs from the stream creator's ID.
Monitor for RoleMember accounts issuing requests to terminal or file-manager WebSocket paths at unusual frequency.

Monitoring Recommendations

Enable verbose request logging on the Nezha dashboard and forward events to a centralized log store for correlation.
Review agent-side command execution history on monitored servers and compare against expected administrator activity.
Track authentication events for RoleMember accounts and flag those interacting with administrative session endpoints.

How to Mitigate CVE-2026-62283

Immediate Actions Required

Upgrade Nezha Monitoring to version 2.0.10 or later, which binds stream identifiers to the creating user.
Rotate all Nezha dashboard credentials and audit the RoleMember user list for unexpected accounts.
Review recent shell command history and filesystem changes on all agents managed by the affected dashboard.

Patch Information

The fix is available in Nezha Release v2.0.10. The patch modifies CreateStream to accept the creator's user ID and enforces ownership at attach time. Technical details are documented in GitHub Security Advisory GHSA-q6xx-5vr8-p898 and the remediation commit.

Workarounds

Restrict dashboard access to trusted operators only and remove or disable RoleMember accounts until the upgrade is applied.
Place the Nezha dashboard behind a reverse proxy that requires additional authentication for the /ws/terminal/ and /ws/file/ paths.
Disable outbound links from the dashboard or scrub Referer headers to reduce accidental UUID exposure.

bash

# Upgrade Nezha Monitoring to the patched version
docker pull ghcr.io/nezhahq/nezha:v2.0.10
docker stop nezha-dashboard && docker rm nezha-dashboard
# Restart with the same volumes/config using the v2.0.10 image

# Verify version after upgrade
curl -s https://<dashboard-host>/api/v1/version