Description
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
Published: 2026-10-30
Score: 6 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service (Crash)
Action: Update
AI Analysis

Impact

A NULL pointer dereference occurs in the ServiceSentinel.loadTodayStats function during dashboard startup. When an authenticated user deletes a service via the batch delete API, orphaned service_histories records remain. On the next dashboard startup the function dereferences a null pointer, causing the process to crash. The result is a denial of service that removes dashboard availability until the offending history records are removed manually or the software is updated.

Affected Systems

The vulnerability affects the Nezha monitoring platform, version 2.0.0 through any release prior to 2.4.0. Systems running any of the affected versions will expose the dashboard login endpoint and the batch delete API, allowing authenticated users to trigger the crash.

Risk and Exploitability

The CVSS score of 6.0 indicates a moderate severity. The EPSS rating is not available, and the flaw is not part of the CISA KEV catalog. Because the bug requires authentication and occurs on startup, an attacker must first authenticate to the dashboard, then delete a service, after which the system will crash on the next restart. Precautionary measures such as blocking the delete endpoint or monitoring service history deletions can mitigate exploitation until a patch is applied.

Generated by OpenCVE AI on October 30, 2026 at 20:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Nezha to version 2.4.0 or newer, which removes the null pointer dereference.
  • Temporarily restrict or disable the POST /api/v1/batch-delete/service endpoint for authenticated users until a patch is applied.
  • After an upgrade, review and delete any orphaned service_histories entries or restart the dashboard to confirm stability.

Generated by OpenCVE AI on October 30, 2026 at 20:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Nezhahq
Nezhahq nezha
Vendors & Products Nezhahq
Nezhahq nezha

Fri, 30 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
Title Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Nezhahq Nezha
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T18:52:58.489Z

Reserved: 2026-10-30T18:41:10.405Z

Link: CVE-2026-120046

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-30T19:18:22.930

Modified: 2026-10-30T19:18:23.060

Link: CVE-2026-120046

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T20:30:14Z

Weaknesses