CVE-2026-111387: Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.
Affected Software
Event History
Frequently Asked Questions
Which accounts can retrieve the exposed credentials?
Any authenticated admin account or personal access token with the nezha:ddns:read scope can call GET /api/v1/ddns and read the affected fields.
What information is exposed through the endpoint?
The endpoint can return cleartext tokens embedded in every user's DDNS webhook profiles because WebhookURL and WebhookRequestBody are not redacted.
Which deployments are affected?
Nezha versions from 2.2.5 before 2.3.15 are affected. Exposure requires DDNS webhook profiles containing credentials and an authenticated caller with the required read permission.
How can I check for exposure?
Review access to GET /api/v1/ddns, including admin accounts and PATs granted nezha:ddns:read. If the response exposed WebhookURL or WebhookRequestBody values containing tokens, those third-party credentials should be treated as disclosed.