CVE-2026-62283

Nezha Monitoring (a self-hostable server and website monitoring tool) versions 1.14.13–1.14.14 and 2.0.0–2.0.9 contain a cross-tenant session hijack vulnerability. Stream identifiers created by CreateStream in service/rpc/io_stream.go are not bound to their creating user, and the WebSocket endpoi...

GO-2026-5821 Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check in github.com/nezhahq/nezha

Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check in github.com/nezhahq/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If thi...