---
id: CVE-2026-59155
title: >-
  Nezha Monitoring is a self-hostable, lightweight, servers and websites
  monitoring and O&M tool
summary: >-
  Nezha Monitoring is a self-hostable, lightweight, servers and websites
  monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET
  /api/v1/notification endpoints return full resource objects including
  plaintext third-party API …
severity: none
cwe:
  - CWE-200
published: '2026-07-10'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59155'
references:
  - url: >-
      https://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e
    label: security-advisories@github.com
  - url: 'https://github.com/nezhahq/nezha/releases/tag/v2.2.5'
    label: security-advisories@github.com
  - url: 'https://github.com/nezhahq/nezha/security/advisories/GHSA-ww5p-j6cj-6mqq'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00483
epssPercentile: 0.38969
ingestedAt: '2026-07-11T22:16:00.826Z'
---

## Overview

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.