ServiceSentinel.worker improperly referenced internal data after a service was deleted by an authorized RoleMember, producing a nil pointer dereference that caused a panic. The gRPC server lacked a recovery interceptor, so the panic terminated the dashboard process and disrupted all tenants’ web interfaces, REST API, and agent connections. The vulnerability does not leak or modify data; it affects availability only. The weakness corresponds to race condition (CWE-362) and null pointer dereference (CWE-476).

Nezha Monitoring, a self‑hostable servers and websites monitoring tool released by nezhahq, is affected by this flaw. Vulnerable releases include versions 2.2.7 through 2.2.10 and any earlier releases; the issue is fixed in version 2.2.11 and in the subsequent release 2.3.0. All instances running those affected versions are susceptible.

The CVSS score of 6.5 marks the flaw as moderate in severity. An attacker with RoleMember rights can trigger the denial of service by concurrently reporting results and deleting a service. The threat does not rely on remote exploitation beyond the gRPC endpoint; it requires access to the internal dashboard but would be feasible for anyone with the appropriate role or compromised credentials. The EPSS score is < 1%, and the flaw is not listed in the CISA KEV catalog. The impact is a complete interruption of service for all tenants, but the attack does not disclose or alter data.