CVE-2026-120046

CVE-2026-120046CVE-2026-120046

Description

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Last modified2026-10-30
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.