CVE-2026-59155

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions prior to 2.2.5

Description The software fails to redact sensitive information when returning resource objects. Authenticated administrators or Personal Access Tokens (PAT) with nezha:ddns:read or nezha:notification:read scopes can retrieve plaintext third-party API credentials. This includes Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs containing bot tokens, as well as Authorization header values. The exposure occurs through the listDDNS and listNotification handlers via the 'GET /api/v1/ddns' and 'GET /api/v1/notification' endpoints.

Recommendations Update to version 2.2.5.