CVE-2026-59155: Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API

Vulnerability summary

CVE-2026-59155 is a medium (CVSS 6.9) vulnerability in nezhahq nezha. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.6% of scored vulnerabilities.

Timeline

1. 10-07-2026
   PublishedVulnerability first disclosed.
2. 13-07-2026
   Last modifiedVulnerability information updated.

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.