CVE-2026-120046— Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History
Quick assessment
Affected
nezhahq nezha
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nezha 2.0.0 至 2.4.0 之前的版本中，ServiceSentinel.loadTodayStats 函数存在空指针解引用漏洞。该漏洞允许已认证用户通过删除服务来导致仪表盘崩溃。攻击者可通过 POST /api/v1/batch-delete/service 接口删除自己的服务，从而留下孤立的 service_histories 记录；这些记录会在非 TSDB 仪表盘下次启动时引发崩溃，除非手动移除这些记录。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-120046
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History
Source: CVE Program / CVE List V5
Vulnerability Description
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-120046
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-120046
请登录查看更多情报信息。
Other References for CVE-2026-120046 (6)
-
https://github.com/nezhahq/nezha product
-
https://github.com/nezhahq/nezha/releases/tag/v2.4.0 release-notes
IV. Related Vulnerabilities
Same product: nezha
-
CVE-2026-111387
Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS Li -
CVE-2026-111386
Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration -
CVE-2026-111385
Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Tran -
CVE-2026-111384
Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager -
CVE-2026-111383
Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/
Same vendor: nezhahq
-
CVE-2026-111387
Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS Li -
CVE-2026-111386
Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration -
CVE-2026-111385
Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Tran -
CVE-2026-111384
Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager -
CVE-2026-111383
Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/
Same weakness: CWE-476
-
CVE-2026-59993
Picotls has NULL pointer dereference during handshake, when -
CVE-2026-62966
ESPAsyncWebServer multipart parser has null-pointer write -
CVE-2026-62298
asn1c: ASAN crash with decode of open types -
CVE-2026-119842
Gst-plugins-base: gst-plugins-base: null-pointer dereference -
CVE-2026-119728
Gst-plugins-bad: gst-plugins-bad: null pointer dereference i