CVE-2026-59155
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.
- Affected products
- Nezha Monitoring
- Fix
- Available
- CVSS 4.0
- 6.9 MEDIUM
- EPSS
- 0.5% (40th percentile)
- Weakness
- CWE-200
- NVD status
- Deferred
- Published
- 2026-07-10
No indexed exploits for CVE-2026-59155 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-59155 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.