# CVE-2026-62283: Nezha Monitoring insufficient stream authorization in websocket endpoints

Source: https://junglewise.ai/threats/cve-2026-62283-nezha-monitoring-insufficient-stream-authorization-in-websocket  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62283 · Severity: critical · CVSS 9.9 · Published 2026-08-21

Nezha Monitoring is a self-hosted server and website monitoring tool. An authenticated user can hijack another user's active terminal or file-manager session by reusing the session identifier exposed in logs, browser history, or referrer data. This allows an attacker to read/write files and execute shell commands on servers managed by other users.

Technologies: [github.com/nezhahq/nezha (Go)](https://junglewise.ai/threats/technologies/github-com-nezhahq-nezha). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-62283 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62283 being exploited in the wild.

**How severe is CVE-2026-62283?** Critical severity, with a CVSS score of 9.9, published 21 August 2026.

**Which products and versions are affected?** github.com/nezhahq/nezha (Go) SEMVER:introduced=0, SEMVER:introduced=1.14.13,last_affected=1.14.14.

**Is there a fix for CVE-2026-62283?** A patch was published on 2026-05-18: Fix commit dated 2026-05-18; version 2.0.10 released 2026-05-19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62283 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-62283?** Check whether you run github.com/nezhahq/nezha (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the WebSocket stream handling of Nezha's RPC service. The CreateStream function in service/rpc/io_stream.go does not bind stream UUIDs to their creating user, and the GET /ws/terminal/:id and GET /ws/file/:id endpoints only verify that a supplied UUID exists without checking ownership. An authenticated RoleMember who obtains a valid stream UUID—via logs, browser history, referrer data, or error telemetry—can attach to another user's live session. The attack requires authentication to the Nezha service but no interaction from the target user. The fix, released in version 2.0.10, binds the creator's user ID to the ioStreamContext at creation time and enforces ownership checks before WebSocket upgrade.

## Affected products

- Nezha Monitoring 1.14.13–1.14.14, 2.0.0–2.0.9

## Identifiers

- CVE-2026-62283
- GHSA-q6xx-5vr8-p898
- GO-2026-5821

## Timeline

- 2026-08-21: disclosed
- 2026-05-18: patched: Fix commit dated 2026-05-18; version 2.0.10 released 2026-05-19

## References

- [https://github.com/nezhahq/nezha/commit/6661d6a7fc1c269f55c7f4e775082ad23fbe0f54](https://github.com/nezhahq/nezha/commit/6661d6a7fc1c269f55c7f4e775082ad23fbe0f54)
- [https://github.com/nezhahq/nezha/releases/tag/v2.0.10](https://github.com/nezhahq/nezha/releases/tag/v2.0.10)

## Related threats

- [Nezha monitoring dashboard denial of service via service deletion race](https://junglewise.ai/threats/cve-2026-100394-nezha-monitoring-whole-instance-dos-in-nezha-dashboard-a-member)
- [Nezha Host header injection in OAuth2 redirect endpoint](https://junglewise.ai/threats/cve-2026-101090-nezha-2-2-3-contains-a-host-header-injection-regression-in-the)
- [Nezha OAuth2 redirect_uri Host header injection regression](https://junglewise.ai/threats/nezha-oauth2-redirect-uri-host-header-injection-regression-331e924a)
- [Nezha Monitoring plaintext credential exposure in DDNS and Notification APIs](https://junglewise.ai/threats/cve-2026-59155-nezha-monitoring-plaintext-credential-exposure-in-ddns-and)
- [Nezha Monitoring Host Header Injection in OAuth2 callback](https://junglewise.ai/threats/cve-2026-53523-nezha-monitoring-host-header-injection-in-oauth2-callback)