CVE-2026-59155: Nezha Monitoring Credential Disclosure Flaw

CVE-2026-59155 Overview

Nezha Monitoring is a self-hostable, lightweight servers and websites monitoring and operations tool. CVE-2026-59155 is an information disclosure vulnerability [CWE-200] in versions prior to 2.2.5. The GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects containing plaintext third-party credentials without field-level redaction. Exposed data includes Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values. Any authenticated admin or Personal Access Token (PAT) with nezha:ddns:read or nezha:notification:read scope can retrieve these credentials in a single API response. The issue is fixed in version 2.2.5.

Critical Impact
Authenticated users with read scopes on DDNS or notification resources can harvest stored third-party API tokens, webhook URLs, and Authorization headers in a single request, enabling lateral movement into Cloudflare, TencentCloud, Slack, Discord, and Telegram integrations.

Affected Products

Nezha Monitoring versions prior to 2.2.5
listDDNS handler in cmd/dashboard/controller/ddns.go
listNotification handler in cmd/dashboard/controller/notification.go

Discovery Timeline

2026-07-10 - CVE-2026-59155 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-59155

Vulnerability Analysis

The flaw resides in two list handlers that serialize stored resource objects directly to API responses. The listDDNS handler returns DDNS profiles that include an AccessSecret field and a WebhookHeaders field. The listNotification handler returns notification configurations containing URL, RequestHeader, and RequestBody fields. All of these fields hold secret material used for outbound integrations.

Because no field-level redaction is applied, callers with read scopes receive the write-time secrets on every list call. Credentials are consumed by many disparate providers, so a single response can seed follow-on attacks against Cloudflare DNS, TencentCloud infrastructure, and chat platforms operating over Slack, Discord, or Telegram bot tokens.

Root Cause

The root cause is missing output filtering on read endpoints. The copier.Copy call clones the singleton objects into response DTOs but preserves every field, including sensitive ones. The handlers then return the copies without stripping secrets.

Attack Vector

An attacker requires an authenticated session or a PAT scoped to nezha:ddns:read or nezha:notification:read. From the network, the attacker issues a single GET /api/v1/ddns or GET /api/v1/notification request and parses the returned JSON for credential fields. No user interaction is required.

// Patch: cmd/dashboard/controller/ddns.go
// Redact third-party credentials from list responses.
// ddnsProfiles is a copier-produced copy, so zeroing is safe
// and does not affect the singleton's original data.
for _, p := range ddnsProfiles {
    p.AccessSecret = ""
    p.WebhookHeaders = ""
}

return ddnsProfiles, nil

Source: GitHub Commit 39d3980

// Patch: cmd/dashboard/controller/notification.go
if err := copier.Copy(¬ifications, &slist); err != nil {
    return nil, err
}

// Redact write-time credentials from list responses.
for _, n := range notifications {
    n.URL = ""
    n.RequestHeader = ""
    n.RequestBody = ""
}
return notifications, nil

Source: GitHub Commit 39d3980

Detection Methods for CVE-2026-59155

Indicators of Compromise

Access log entries for GET /api/v1/ddns or GET /api/v1/notification from unusual client IPs or user agents.
Sudden growth in response size for these endpoints, indicating enumeration of stored profiles.
PAT usage where the token exercises only nezha:ddns:read or nezha:notification:read scopes and no other operational endpoints.
Outbound activity to Cloudflare, TencentCloud, or webhook endpoints from hosts that do not normally initiate such traffic.

Detection Strategies

Enable HTTP access logging on the Nezha dashboard and alert on repeated requests to the two affected endpoints.
Correlate DDNS and notification list reads with subsequent authentication events at Cloudflare, TencentCloud, Slack, Discord, and Telegram bot APIs.
Baseline PAT usage patterns and flag tokens that only exercise the vulnerable read scopes.

Monitoring Recommendations

Rotate all Cloudflare API tokens, TencentCloud SecretKeys, and chat webhook URLs used by Nezha instances that ran a pre-2.2.5 build.
Monitor upstream provider audit logs for token use from unfamiliar source IPs after the exposure window.
Alert on any new PAT creation carrying nezha:ddns:read or nezha:notification:read scopes.

How to Mitigate CVE-2026-59155

Immediate Actions Required

Upgrade Nezha Monitoring to version 2.2.5 or later, which redacts credentials in list responses.
Rotate every third-party credential stored in DDNS profiles and notification configurations, including Cloudflare tokens, TencentCloud SecretKeys, webhook URLs, and Authorization headers.
Audit existing PATs and revoke any token that carries nezha:ddns:read or nezha:notification:read unless the scope is required.
Review admin account activity for unexpected calls to the affected endpoints.

Patch Information

The fix is available in Nezha v2.2.5 and applied in commit 39d3980. Details are published in the GHSA-ww5p-j6cj-6mqq advisory. The patch zeroes AccessSecret, WebhookHeaders, URL, RequestHeader, and RequestBody on the response copies produced by copier.Copy, preserving singleton state while removing secrets from the wire.

Workarounds

Restrict network access to the Nezha dashboard so that only trusted operator networks can reach /api/v1/ddns and /api/v1/notification.
Remove nezha:ddns:read and nezha:notification:read scopes from all PATs until upgrade is complete.
If upgrade is delayed, disable DDNS and notification integrations and clear stored credentials until the fixed version is deployed.

bash

# Upgrade Nezha to the fixed release
docker pull ghcr.io/nezhahq/nezha:v2.2.5
docker stop nezha-dashboard && docker rm nezha-dashboard
# Recreate the container with the patched image, then rotate all
# stored Cloudflare, TencentCloud, Slack, Discord, and Telegram credentials.