CVE-2026-59155

unknowncovered by 1 sourcefirst seen 2026-07-10

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.

⚡ Watch CVE-2026-59155

Get an email if CVE-2026-59155 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-59155: Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool…nvd · 2026-07-10

External references

NVD record for CVE-2026-59155

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-59155 status](https://www.csirts.com/badge/CVE-2026-59155)](https://www.csirts.com/cve/CVE-2026-59155)