CVE-2026-120046mediumCWE-476

CVE-2026-120046: falha de média gravidade em nezhahq nezha

Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar nezha

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6epss 0.3%
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
nezhahq · nezha
CVEs relacionadas — nezhahq nezha

No mesmo produto, das mais perigosas para as menos.

CVE-2026-53519CRITICALNezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_keyEPSS 1.9%CVE-2026-62283CRITICALNezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership checkEPSS 0.6%CVE-2026-100394MEDIUMNezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantEPSS 0.5%CVE-2026-101090CRITICALNezha through 2.2.3 Host Header Injection via OAuth2 redirect_uriEPSS 0.4%CVE-2026-46716CRITICALNezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cronEPSS 0.4%CVE-2026-59155MEDIUMNezha Monitoring: DDNS and Notification credential exposure via unredacted list APIEPSS 0.4%