Is CVE-2026-62283 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62283 being exploited in the wild.

How severe is CVE-2026-62283?

Critical severity, with a CVSS score of 9.9, published 21 August 2026.

Which products and versions are affected?

github.com/nezhahq/nezha (Go) SEMVER:introduced=0, SEMVER:introduced=1.14.13,last_affected=1.14.14.

Is there a fix for CVE-2026-62283?

A patch was published on 2026-05-18: Fix commit dated 2026-05-18; version 2.0.10 released 2026-05-19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62283 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-62283?

Check whether you run github.com/nezhahq/nezha (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62283: Nezha Monitoring insufficient stream authorization in websocket endpoints

CVE-2026-62283 · Severity: critical · CVSS 9.9 · Published 2026-08-21

Nezha Monitoring is a self-hosted server and website monitoring tool. An authenticated user can hijack another user's active terminal or file-manager session by reusing the session identifier exposed in logs, browser history, or referrer data. This allows an attacker to read/write files and execute shell commands on servers managed by other users.

Technologies: github.com/nezhahq/nezha (Go). Vendors: Go.

Quick answers

Is CVE-2026-62283 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62283 being exploited in the wild.
How severe is CVE-2026-62283?: Critical severity, with a CVSS score of 9.9, published 21 August 2026.
Which products and versions are affected?: github.com/nezhahq/nezha (Go) SEMVER:introduced=0, SEMVER:introduced=1.14.13,last_affected=1.14.14.
Is there a fix for CVE-2026-62283?: A patch was published on 2026-05-18: Fix commit dated 2026-05-18; version 2.0.10 released 2026-05-19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62283 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-62283?: Check whether you run github.com/nezhahq/nezha (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the WebSocket stream handling of Nezha's RPC service. The CreateStream function in service/rpc/io_stream.go does not bind stream UUIDs to their creating user, and the GET /ws/terminal/:id and GET /ws/file/:id endpoints only verify that a supplied UUID exists without checking ownership. An authenticated RoleMember who obtains a valid stream UUID—via logs, browser history, referrer data, or error telemetry—can attach to another user's live session. The attack requires authentication to the Nezha service but no interaction from the target user. The fix, released in version 2.0.10, binds the creator's user ID to the ioStreamContext at creation time and enforces ownership checks before WebSocket upgrade.

Affected products

Nezha Monitoring 1.14.13–1.14.14, 2.0.0–2.0.9

Identifiers

CVE-2026-62283
GHSA-q6xx-5vr8-p898
GO-2026-5821

Timeline

2026-08-21: disclosed
2026-05-18: patched: Fix commit dated 2026-05-18; version 2.0.10 released 2026-05-19

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.