EUVD-2026-64139Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AV:N and PR:L (any authenticated member); AC:H because the attacker must obtain a live UUID via an out-of-band leak and race an active session; S:C and C/I/A:H reflect RCE on a separate monitored server.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user, and GET /ws/terminal/:id and GET /ws/file/:id only check whether the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer data, or telemetry can attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. This issue is fixed in version 2.0.10.
AnalysisAI
Cross-tenant session hijacking in Nezha Monitoring (v1.14.13-1.14.14 and v2.0.0-2.0.9) lets any authenticated low-privilege RoleMember attach to another user's live WebSocket terminal or file-manager session and gain interactive shell access and full file read/write on the monitored target server. The flaw stems from stream UUIDs at GET /ws/terminal/:id and GET /ws/file/:id being validated only for existence, never bound to their creating user, so an attacker who learns a live UUID from access logs, referer headers, browser history, or telemetry breadcrumbs achieves cross-tenant remote code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Nezha dashboard account of at least RoleMember (PR:L), plus a currently-live terminal or file-manager stream created by another user, plus knowledge of that session's stream UUID obtained from a side channel - specifically reverse-proxy access logs, Referer headers, browser history/bookmark sync, frontend telemetry (Sentry/Bugsnag) breadcrumbs, or a shared-tenant log viewer, because the UUID is exposed as the URL path component of /ws/terminal/:id or /ws/file/:id. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent toward high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Nezha v2.0.10, which binds each stream to its creator UID and enforces IsStreamAuthorizedForUser before the WebSocket upgrade (commit 6661d6a, advisory GHSA-q6xx-5vr8-p898, release https://github.com/nezhahq/nezha/releases/tag/v2.0.10). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct inventory of all Nezha Monitoring deployments to identify systems running v1.14.13-1.14.14 or v2.0.0-2.0.9, prioritizing production infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated path traversal in Nezha Monitoring (nezhahq/nezha) before 2.0.13 allows remote attackers to read arbitra
Nezha Monitoring versions prior to 2.2.5 expose stored third-party API credentials in plaintext through two listing API
Host header injection in Nezha Monitoring versions 1.0.0 through 2.2.0 allows unauthenticated remote attackers to redire
Unbounded WebSocket stream allocation in Nezha Monitoring versions 1.0.0 through 2.1.x allows any authenticated dashboar
Nezha Monitoring versions 2.0.14 through 2.1.0 (exclusive) allows any authenticated user to exploit the NAT-based Host c
Incorrect authorization in Nezha Monitoring's DDNS profile subsystem allows an authenticated low-privilege member to pre
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today