CVE-2026-100394 nezhahq CVE debrief

Who should care

Defenders responsible for Nezha dashboard deployments should assess exposure and prioritize upgrading to version 2.2.11 or later. They should also monitor for unusual activity and review logs for signs of exploitation.

Why it matters

Defenders should prioritize upgrading to version 2.2.11 or later and verify the fix is applied. They should also monitor for unusual activity and review logs for signs of exploitation. The vulnerability can cause a denial of service for all tenants, potentially impacting business operations.

• Denial of service for all tenants
• Potential for data loss or corruption due to service disruption
• Need for verification of fix application
• Possible impact on business operations due to service unavailability

Technical summary

The vulnerability is caused by a race condition in the service-monitor worker, which checks a service exists under one lock and later writes to two pointer-valued status maps under a different lock. A concurrent delete can remove the entries in the gap, causing a nil pointer dereference and killing the whole process. This issue is fixed in `v2.2.11` and later; users should upgrade to the latest release, `v2.3.0`. The crash is a nil pointer dereference in the service-monitor worker at `service/singleton/servicesentinel.go:601`. Availability only: nothing is read or modified. Defenders should prioritize upgrading to version 2.2.11 or later and verify the fix is applied.

Defensive priority

Defenders should prioritize upgrading to version 2.2.11 or later, and verify the fix is applied. They should also monitor for unusual activity and review logs for signs of exploitation.

Recommended defensive actions

• Upgrade to version 2.2.11 or later
• Monitor for unusual activity
• Review logs for signs of exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source corpus provides details on the vulnerability, including the affected versions (confirmed in `v2.2.7` through `v2.2.10`) and the fix in `v2.2.11` and later. However, there is no information on exploitation or victims. Defenders should verify the fix is applied and monitor for unusual activity. The vulnerability causes a denial of service for all tenants, potentially impacting business operations. To verify the fix, defenders should review logs for signs of exploitation and ensure the upgrade to version 2.2.11 or later is 100

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.