{"id":"CVE-2026-100394","kind":"vulnerability","aliases":["CVE-2026-100394","GHSA-qjpp-gffx-2wm9","GO-2026-6794"],"related":[],"title":"Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and serviceCurrentStatusData entries under serviceResponseDataStoreLock without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember could concurrently report TCP or ICMP results through the member's own agent and delete the same owned service, causing a nil pointer dereference. Because the gRPC server had no recovery interceptor, the worker panic terminated the whole dashboard process and disrupted every tenant's web interface, REST API, and agent connections. The issue affects availability only and does not disclose or modify data. This issue is fixed in versions 2.2.11 and 2.3.0.","summary":"A race in Nezha's service sentinel lets a member-role user crash the whole dashboard process by reporting TCP or ICMP results through their own agent while deleting a service they own. The crash takes down the web UI, REST API and agent connections for every tenant, but data is not disclosed or modified.","severity":"medium","cvss":6.5,"epss":0.00423,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/nezhahq/nezha","fixed":["0.0.0-20260721131105-c893aa57867d"],"affected":">= 0.0.0-20260628010923-fd31e5f1b0f8, < 0.0.0-20260721131105-c893aa57867d","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","multi-tenant","nezha","package","self-hosted"],"not_affected_if":["managed-hosting","no-member-role-users","versions-outside-2.2.7-2.2.11"],"how_to_check":"Check the version of github.com/nezhahq/nezha in go.mod or the running build; affected range is from 2.2.7 through 2.2.11 (commit before 0.0.0-20260721131105-c893aa57867d).\nIf self-hosting the dashboard, run the binary version or check the image tag.","fix":"Upgrade to Nezha 2.2.11 or 2.3.0 (go module 0.0.0-20260721131105-c893aa57867d or later).\nRestrict member role accounts if an upgrade must wait, since the attacker needs a RoleMember account.","status":"open","published_at":"2026-10-14T16:17:28+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:57:49+00:00","updated_at":"2026-10-23T19:57:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:57:49Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to Nezha 2.2.11 or 2.3.0 (go module 0.0.0-20260721131105-c893aa57867d or later).\nRestrict member role accounts if an upgrade must wait, since the attacker needs a RoleMember account.","summary":"A race in Nezha's service sentinel lets a member-role user crash the whole dashboard process by reporting TCP or ICMP results through their own agent while deleting a service they own. The crash takes down the web UI, REST API and agent connections for every tenant, but data is not disclosed or modified.","category":"package","who_cares":["nezha","self-hosted","go","multi-tenant"],"confidence":0.8,"analyst_note":"","how_to_check":"Check the version of github.com/nezhahq/nezha in go.mod or the running build; affected range is from 2.2.7 through 2.2.11 (commit before 0.0.0-20260721131105-c893aa57867d).\nIf self-hosting the dashboard, run the binary version or check the image tag.\nunknown for any log-based detection.","needs_analyst":false,"not_affected_if":["managed-hosting","versions-outside-2.2.7-2.2.11","no-member-role-users"],"severity_if_unknown":"medium"},"cost_usd":0.000459,"input_tokens":2435,"output_tokens":431,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-100394':25A,36A '-2026':24A,32A,35A '-6794':33A '/nezhahq/nezha':22A,39A '2.2.11':124C,226C '2.2.7':122C '2.3.0':228C '2wm9':30A 'affect':210C 'agent':76B,93B,168C,206C 'api':91B,204C 'avail':211C 'caus':175C 'check':128C 'concurr':157C 'connect':94B,207C 'could':156C 'crash':13A,62B,84B 'cve':23A,34A 'dashboard':9A,65B,194C 'data':99B,219C 'delet':78B,170C 'derefer':179C 'dereferenc':136C 'disclos':102B,216C 'disrupt':197C 'dos':6A 'entri':143C 'everi':17A,96B,198C 'fix':223C 'gffx':29A 'ghsa':27A 'ghsa-qjpp-gffx-2wm9':26A 'github.com':21A,38A 'github.com/nezhahq/nezha':20A,37A 'go':31A,40B 'grpc':182C 'host':48B 'hostabl':111C 'icmp':71B,161C 'instanc':5A 'interceptor':187C 'interfac':202C 'issu':209C,221C 'later':135C 'let':56B 'lightweight':112C 'm':119C 'member':11A,59B,165C 'member-rol':58B 'modifi':104B,218C 'monitor':2A,106C,116C 'multi':42B 'multi-ten':41B 'nezha':1A,8A,44B,52B,105C 'nil':177C 'o':118C 'own':130C,173C 'packag':45B 'panic':190C 'pointer':138C,178C 'pointer-valu':137C 'process':15A,66B,195C 'qjpp':28A 'race':50B 'recoveri':186C 'remov':152C 'report':68B,158C 'rest':90B,203C 'result':72B,162C 'revalid':147C 'role':60B 'rolememb':155C 'self':47B,110C 'self-host':46B,109C 'sentinel':55B 'server':113C,183C 'servic':54B,80B,131C,174C 'service/singleton/servicesentinel.go':127C 'servicecurrentstatusdata':142C 'serviceresponsedatastorelock':145C 'servicesentinel.delete':149C 'servicesentinel.worker':125C 'serviceslock':133C 'servicestatustoday':140C 'take':85B 'tcp':69B,159C 'tenant':18A,43B,97B,199C 'termin':191C 'tool':120C 'ui':89B 'user':61B 'valu':139C 'version':225C 'web':88B,201C 'websit':115C 'whole':4A,64B,193C 'whole-inst':3A 'without':146C 'worker':189C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-14T16:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6794","url":"https://pkg.go.dev/vuln/GO-2026-6794","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-100394","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100394","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-100394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100394","severity":null,"published_at":"2026-10-14T16:17:28+00:00","modified_at":"2026-10-14T16:17:28+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}