CVE-2026-100394: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in nezhahq nezha

Nezha Monitoring, a self-hosted monitoring tool, contains a race condition vulnerability (CWE-362) in the ServiceSentinel.worker code between versions 2.2.7 and 2.2.10. The worker checks a service under one lock but later dereferences pointers under another lock without revalidating if the service was deleted concurrently. A RoleMember can exploit this by simultaneously reporting TCP or ICMP results and deleting the same service, causing a nil pointer dereference. Because the gRPC server lacks a recovery interceptor, this panic crashes the entire dashboard process, disrupting all tenants' interfaces and connections. The vulnerability impacts availability but does not disclose or modify data. Fixed in 2.2.11 and 2.3.0.

Exploitation causes a denial of service by crashing the dashboard process, which disrupts the web interface, REST API, and agent connections for all tenants. There is no impact on data confidentiality or integrity.

Upgrade Nezha Monitoring to version 2.2.11 or later, or 2.3.0 or later, where this race condition vulnerability is fixed. No other mitigation is indicated or required.