Executive brief
Nezha Monitoring is a self-hosted server and website monitoring tool. An authenticated user can hijack another user's active terminal or file-manager session by reusing the session identifier exposed in logs, browser history, or referrer data. This allows an attacker to read/write files and execute shell commands on servers managed by other users.
Technical details
The vulnerability is an authorization bypass in the WebSocket stream handling of Nezha's RPC service. The CreateStream function in service/rpc/io_stream.go does not bind stream UUIDs to their creating user, and the GET /ws/terminal/:id and GET /ws/file/:id endpoints only verify that a supplied UUID exists without checking ownership. An authenticated RoleMember who obtains a valid stream UUID—via logs, browser history, referrer data, or error telemetry—can attach to another user's live session. The attack requires authentication to the Nezha service but no interaction from the target user. The fix, released in version 2.0.10, binds the creator's user ID to the ioStreamContext at creation time and enforces ownership checks before WebSocket upgrade.
Affected products
- Nezha Monitoring 1.14.13–1.14.14, 2.0.0–2.0.9
Timeline
- 2026-08-21: disclosed
- 2026-05-18: patched: Fix commit dated 2026-05-18; version 2.0.10 released 2026-05-19