---
id: "CVE-2026-100394"
kind: "vulnerability"
aliases: ["CVE-2026-100394", "GHSA-qjpp-gffx-2wm9", "GO-2026-6794"]
title: "Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha"
severity: "medium"
cvss: 6.5
epss: 0.00423
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/nezhahq/nezha", "fixed": ["0.0.0-20260721131105-c893aa57867d"], "affected": ">= 0.0.0-20260628010923-fd31e5f1b0f8, < 0.0.0-20260721131105-c893aa57867d", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "multi-tenant", "nezha", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "no-member-role-users", "versions-outside-2.2.7-2.2.11"]
published_at: "2026-10-14T16:17:28+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:57:49+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6794", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-100394", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100394", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha

A race in Nezha's service sentinel lets a member-role user crash the whole dashboard process by reporting TCP or ICMP results through their own agent while deleting a service they own. The crash takes down the web UI, REST API and agent connections for every tenant, but data is not disclosed or modified.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/nezhahq/nezha affected >= 0.0.0-20260628010923-fd31e5f1b0f8, < 0.0.0-20260721131105-c893aa57867d fixed 0.0.0-20260721131105-c893aa57867d

## How to check

Check the version of github.com/nezhahq/nezha in go.mod or the running build; affected range is from 2.2.7 through 2.2.11 (commit before 0.0.0-20260721131105-c893aa57867d).
If self-hosting the dashboard, run the binary version or check the image tag.

## Fix

Upgrade to Nezha 2.2.11 or 2.3.0 (go module 0.0.0-20260721131105-c893aa57867d or later).
Restrict member role accounts if an upgrade must wait, since the attacker needs a RoleMember account.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6794
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-100394
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100394

## From the sources

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and serviceCurrentStatusData entries under serviceResponseDataStoreLock without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember could concurrently report TCP or ICMP results through the member's own agent and delete the same owned service, causing a nil pointer dereference. Because the gRPC server had no recovery interceptor, the worker panic terminated the whole dashboard process and disrupted every tenant's web interface, REST API, and agent connections. The issue affects availability only and does not disclose or modify data. This issue is fixed in versions 2.2.11 and 2.3.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_