CVE-2026-101088

Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go) contains an incomplete fix for a previously reported nil dereference denial of service (GHSA-qjpp-gffx-2wm9). The 2026-07-21 fix re-validated the service lifecycle under serviceResponseDataStoreLock but reused an already-captured, now stale reporter pointer and never re-validated the server, and that lock does not guard ServerShared. An authenticated user with the member role who owns an agent can issue a concurrent server delete (POST /api/v1/batch-delete/server) for their own server to win the race window, causing the worker to dereference a missing entry in the server list snapshot. Because the sentinel workers and the gRPC server have no recover()/recovery interceptor, the resulting panic is unrecovered and crashes the entire instance. This is fixed in version 2.3.1.

• CWE-367

• https://github.com/nezhahq/nezha/security/advisories/GHSA-jx78-55p5-rwv5
• https://www.vulncheck.com/advisories/nezha-before-2.3.1-denial-of-service-via-concurrent-server-delete

Published

Sep 27, 2026

Last Modified

Sep 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-101082A weakness has been identified in PMWeb 7.x/8.x/2025.x. This…5.3
• CVE-2026-101083A security vulnerability has been detected in PMWeb v7.x/v8.…5.3
• CVE-2026-101084obot versions before v0.21.1 fail to enforce Access Control …9.6
• CVE-2026-101085Nezha before 2.3.8 fails to validate alert rule type and dur…6.5
• CVE-2026-101086Nezha Dashboard versions before 2.3.5 fail to restrict servi…6.5
• CVE-2026-101087Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP cl…4.3
• CVE-2026-101089Nezha before 2.2.7 contains an information disclosure vulner…3.1
• CVE-2026-10109IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is …9.8
• CVE-2026-101090Nezha 2.2.3 contains a Host header injection regression in t…9.8
• CVE-2026-101098A security vulnerability has been detected in ag-ui-protocol…4.3
• CVE-2026-101099A vulnerability was detected in ag-ui-protocol ag-ui up to 2…4.3
• CVE-2026-1011A stored cross-site scripting (XSS) vulnerability exists in …6.1