CVE-2026-62283: Nezha Monitoring WebSocket Terminal Stream Hijacking

Executive Summary

CVE-2026-62283 is a CVSS 9.9 critical broken object-level authorization (BOLA) vulnerability in Nezha Monitoring, a popular self-hosted server and website monitoring platform. The flaw is in how Nezha creates and manages WebSocket terminal stream identifiers: stream IDs created by CreateStream in service/rpc/io_stream.go are not bound to the user who created them, meaning any authenticated user can connect to another user's active terminal session using a guessed or discovered stream ID.

The vulnerability affects versions 1.14.13–1.14.14 and 2.0.0–2.0.9. Upgraded versions 1.14.15+ and 2.0.10+ contain the fix.

Vulnerability Details

Root Cause

Nezha's WebSocket terminal feature allows administrators to open interactive shell sessions on monitored servers via the dashboard. When a stream is created via CreateStream, the resulting stream identifier is stored without any binding to the requesting user's session or identity.

Two endpoints are vulnerable:

• GET /ws/terminal/:id — WebSocket terminal connection
• Additional streaming endpoints referencing the same :id parameter

Because the :id is not validated against the requesting user's identity, any authenticated Nezha user who obtains or guesses a valid stream ID can connect to an active terminal session belonging to another user — including administrators — and read or inject commands.

Attack Flow

1. Attacker authenticates to the Nezha dashboard (any valid account)
2. Administrator opens a WebSocket terminal session to a monitored server
   — CreateStream allocates a stream ID (e.g., a UUID or incrementing integer)
3. Attacker discovers the stream ID (via API enumeration, shared logs, or timing)
4. Attacker connects to GET /ws/terminal/<discovered-id>
5. Nezha accepts the connection without verifying ownership
6. Attacker reads the administrator's terminal session in real time
7. Attacker injects arbitrary commands into the terminal stream

Severity Factors

In environments where Nezha is deployed to monitor production infrastructure, exploitation of this vulnerability allows a low-privileged attacker to execute arbitrary commands on every monitored server.

Affected Versions

Earlier 1.x versions (prior to 1.14.13) are not listed as affected. Operators running EOL or untagged builds should upgrade regardless.

Remediation

Upgrade Nezha Dashboard

Update to the patched release for your branch:

# v1 branch
curl -fsSL https://raw.githubusercontent.com/naiba/nezha/main/script/install.sh | bash -s -- install
# Select v1.14.15+ when prompted
 
# v2 branch  
# Follow your deployment method (Docker, binary, or package)
# Ensure version is 2.0.10 or later
docker pull ghcr.io/nezhahq/nezha:latest
docker restart nezha-dashboard

Verify Your Version

# Check the running binary version
nezha-dashboard --version
 
# Or via Docker
docker exec nezha-dashboard nezha-dashboard --version

Interim Mitigation

Until patching is possible:

1. Restrict dashboard access to trusted IP ranges via reverse proxy or firewall
2. Revoke low-privilege accounts that do not require terminal access
3. Avoid using the WebSocket terminal feature until patched — use direct SSH to monitored servers instead
4. Monitor dashboard access logs for unexpected terminal endpoint requests

Detection

Suspicious WebSocket Terminal Access

Review your reverse proxy or application logs for unexpected access to terminal endpoints:

# nginx example
grep "/ws/terminal/" /var/log/nginx/access.log | \
  awk '{print $1, $7, $12}' | sort | uniq -c | sort -rn

SIEM Query (Splunk)

index=web sourcetype=nginx_access
| where match(uri_path, "/ws/terminal/")
| stats count, dc(user) as unique_users by stream_id, src_ip
| where unique_users > 1
| sort -count

A stream ID accessed by more than one distinct user or IP is a strong indicator of exploitation.

Background: Nezha Monitoring

Nezha is a widely deployed open-source monitoring platform used by self-hosters, small businesses, and service providers to track server health, uptime, and resource usage. Its WebSocket terminal feature is designed to eliminate the need for separate SSH clients when administering monitored servers from the dashboard. The broad deployment of Nezha among infrastructure operators makes this vulnerability particularly impactful — successful exploitation effectively grants access to the entire monitored fleet.

References

• NIST NVD — CVE-2026-62283
• Nezha GitHub Repository
• GitHub Security Advisory (naiba/nezha)