PT-2026-133773

CVE-2026-120046

·

Published

2026-10-30

·

Updated

2026-10-30

Description by

CVSS 3.1
5.3
Medium
MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-476: NULL Pointer Dereference
Related identifiers
CVE-2026-120046
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com