Live › vulnerability › CVE-2026-100394
Go to dashboardA race in Nezha's service sentinel lets a member-role user crash the whole dashboard process by reporting TCP or ICMP results through their own agent while deleting a service they own. The crash takes down the web UI, REST API and agent connections for every tenant, but data is not disclosed or modified.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/nezhahq/nezha | go | >= 0.0.0-20260628010923-fd31e5f1b0f8, < 0.0.0-20260721131105-c893aa57867d | 0.0.0-20260721131105-c893aa57867d |
2.2.7 through 2.2.11 (commit before 0.0.0-20260721131105-c893aa57867d)2.2.11 or (go module 0.0.0-20260721131105-c893aa57867d or later)2.3.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and serviceCurrentStatusData entries under serviceResponseDataStoreLock without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember could concurrently report TCP or ICMP results through the member's own agent and delete the same owned service, causing a nil pointer dereference. Because the gRPC server had no recovery interceptor, the worker panic terminated the whole dashboard process and disrupted every tenant's web interface, REST API, and agent connections. The issue affects availability only and does not disclose or modify data. This issue is fixed in versions 2.2.11 and 2.3.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-100394")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.