Nezha Monitoring CVE-2026-62283

Requires an authenticated Nezha dashboard account of at least RoleMember (PR:L), plus a currently-live terminal or file-manager stream created by another user, plus knowledge of that session's stream UUID obtained from a side channel - specifically reverse-proxy access logs, Referer headers, browser history/bookmark sync, frontend telemetry (Sentry/Bugsnag) breadcrumbs, or a shared-tenant log viewer, because the UUID is exposed as the URL path component of /ws/terminal/:id or /ws/file/:id. Limiting factors: exploitation is not possible against a single-user instance (needs another victim user), the target session must be active at attach time, and the attacker must first authenticate to the dashboard; it does NOT require admin rights, user interaction from the victim, or any non-default configuration - the missing ownership check is present in default builds of the affected versions.

Signals are largely consistent toward high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) reflects network-reachable, low-privilege, no-interaction attack with a scope change into the monitored server yielding full CIA loss - plausible given the outcome is shell/file access. The one nuance: exploitation is not fully deterministic because it requires obtaining a currently-live stream UUID via a side channel and racing an active session, which is an attacker-external condition arguably closer to AC:H than AC:L; this is why my independent assessment lowers the score somewhat. EPSS is not provided and cannot be cited. KEV: not listed, so no confirmed active exploitation. POC: no standalone exploit is published, but the fix commit ships explicit ownership-hijack regression tests that document the exact preconditions, materially lowering the bar to weaponization. Net: a legitimately high-priority issue for any multi-user/multi-tenant Nezha deployment, tempered mainly by the need for a UUID leak and a concurrently live victim session rather than any high-CVSS-but-low-real-risk mismatch.

A low-privileged RoleMember on a shared Nezha dashboard monitors the reverse-proxy access logs (or a shared log viewer / Sentry breadcrumbs) and spots an admin opening wss://dashboard/ws/terminal/<UUID> to a production server. While that session is live, the member connects to the same /ws/terminal/<UUID>, which only checks that the UUID exists, and is joined into the bidirectional pipe - gaining an interactive shell on the target server and full file-manager read/write. No public standalone exploit exists, but the fix commit's regression tests demonstrate the exact hijack.