Live › vulnerability › CVE-2026-120046
Nezha versions 2.0.0 before 2.4.0 have a NULL pointer dereference in ServiceSentinel.loadTodayStats. An authenticated user who deletes a service leaves orphaned service history rows that crash the non-TSDB dashboard on its next startup until those rows are removed manually.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Teams that run a self-hosted Nezha dashboard between version 2.0.0 and 2.4.0, where the non-TSDB mode is in use, are exposed. The attack needs a logged-in account that can delete services, so teams with only trusted accounts face low risk. Teams already on 2.4.0 or later can skip it.
No product ranges from the sources yet.
2.4.0.2.4.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
This page as .md · .json · in your agent: get_signal("CVE-2026-120046")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.