CVE-2026-59155: Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nezha Monitoringto a version that resolves this vulnerability.Fixed in 2.2.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59155?
The severity of CVE-2026-59155 is classified as medium with a CVSS score of 6.9.
How do I fix CVE-2026-59155?
To fix CVE-2026-59155, upgrade to Nezha Monitoring version 2.2.5 or later.
What type of vulnerability is CVE-2026-59155?
CVE-2026-59155 is classified as an information leak vulnerability.
What type of information is exposed in CVE-2026-59155?
CVE-2026-59155 exposes plaintext third-party API credentials, including Cloudflare API tokens and TencentCloud secrets.
Which Nezha Monitoring versions are affected by CVE-2026-59155?
CVE-2026-59155 affects Nezha Monitoring versions prior to 2.2.5.