CVE-2026-62283

This vulnerability lets any authenticated user hijack terminal sessions by enumerating stream UUIDs — the system treats these identifiers as opaque secrets rather than credentials bound to the creating user's identity. The UUIDs are discoverable through browser history, referer headers, telemetry, or logs, meaning the protection was obscurity rather than access control. An attacker with no special privileges can enumerate active sessions and inject commands into any terminal. Examine the 2.0.10 patch to determine whether it implements cryptographic binding (HMAC-signed session IDs) or merely adds a server-side user-to-stream mapping table. If it's the latter, the fix is a soft control vulnerable to regression — future developers adding convenience endpoints could easily bypass the mapping. Cryptographic binding makes the pattern physically impossible to reintroduce; database lookups only discourage it. The parallel existence of this flaw in both the 1.14.x and 2.0.x branches suggests the architectural assumption permeates the codebase. Audit other stream lifecycle operations — file transfers, log exports, alert configurations, scheduled task executions — for the same UUID-as-secret pattern. The CVE addresses two endpoints; the underlying assumption likely does not. The CVSS 9.9 undersells operational severity. Nezha operators typically have elevated access across the monitored fleet: SSH agent forwarding, kubectl credentials, VPN tunnels, or API tokens scoped beyond the monitoring host itself. Compromising the monitoring terminal is a lateral movement pivot, not an isolated compromise. Treat the blast radius as the entire infrastructure the operator can reach.

Reviewed through automated stages and approved by a human before publication.