{"id":"CVE-2026-120046","published":"2026-10-30T19:18:22.930","lastModified":"2026-10-30T19:18:23.060","description":"Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-476"],"vendors":[],"products":[],"references":[{"url":"https://github.com/nezhahq/nezha","tags":[]},{"url":"https://github.com/nezhahq/nezha/blob/9881c47f0cc92256ba203919da5a25fab79a6bad/cmd/dashboard/controller/service.go#L639","tags":[]},{"url":"https://github.com/nezhahq/nezha/blob/9881c47f0cc92256ba203919da5a25fab79a6bad/service/singleton/servicesentinel.go#L434","tags":[]},{"url":"https://github.com/nezhahq/nezha/commit/efd3e07b901d6acf7ef2ab3b26458cc07e7605dc","tags":[]},{"url":"https://github.com/nezhahq/nezha/releases/tag/v2.4.0","tags":[]},{"url":"https://www.vulncheck.com/advisories/nezha-2.0.0-before-2.4.0-startup-null-pointer-dereference-via-orphaned-service-history","tags":[]}],"exploitRefs":[{"url":"https://github.com/nezhahq/nezha","tags":[]},{"url":"https://github.com/nezhahq/nezha/blob/9881c47f0cc92256ba203919da5a25fab79a6bad/cmd/dashboard/controller/service.go#L639","tags":[]},{"url":"https://github.com/nezhahq/nezha/blob/9881c47f0cc92256ba203919da5a25fab79a6bad/service/singleton/servicesentinel.go#L434","tags":[]},{"url":"https://github.com/nezhahq/nezha/commit/efd3e07b901d6acf7ef2ab3b26458cc07e7605dc","tags":[]},{"url":"https://github.com/nezhahq/nezha/releases/tag/v2.4.0","tags":[]}],"hasPoc":true,"ai":null}