CVE-2026-101085 nezhahq CVE debrief

Who should care

Defenders and administrators of Nezha installations should assess exposure and prioritize verification and remediation. This includes reviewing alert rule validation, assessing the potential impact on monitoring and control plane functionality, and implementing compensating controls where necessary. Security teams and vulnerability management teams should also be aware of the potential risks and take steps to mitigate them.

Why it matters

CVE-2026-101085 allows authenticated non-administrator users to create malformed alert rules that trigger unrecovered panics in the alert evaluator goroutine, potentially disrupting monitoring and control plane functionality in Nezha installations. Defenders and administrators should assess exposure, verify alert rule validation, and prioritize remediation.

• Denial of service via crafted alert rules
• Potential disruption of monitoring and control plane functionality
• Need for verification of alert rule validation in Nezha versions before 2.3.8
• Priority for upgrading to Nezha version 2.3.8 or later

Technical summary

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. This vulnerability can be exploited via the POST /api/v1/alert-rule endpoint, potentially disrupting monitoring and control plane functionality in Nezha installations. Defenders should prioritize verifying alert rule validation in Nezha versions before 2.3.8 and assessing exposure in their environments. The vulnerability is characterized by insufficient validation of user-supplied input, leading to a denial-of-service condition.

Defensive priority

Defenders should prioritize verifying alert rule validation in Nezha versions before 2.3.8 and assessing exposure in their environments.

Recommended defensive actions

• Verify alert rule validation in Nezha versions before 2.3.8
• Assess exposure in environments using Nezha
• Implement monitoring for abnormal alert rule activity
• Prioritize upgrading to Nezha version 2.3.8 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry indicate that Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.