{"id":"EUVD-2026-43108","enisaUuid":"b4b926ea-7da2-3485-98c0-bc139b76544d","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.","datePublished":"Jul 10, 2026, 9:31:34 PM","dateUpdated":"Jul 13, 2026, 5:56:44 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-ww5p-j6cj-6mqq\nhttps://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e\nhttps://github.com/nezhahq/nezha/releases/tag/v2.2.5\n","aliases":"CVE-2026-59155\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"46950bba-fd43-30a0-ac97-edb510f43f20","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"\u003c 2.2.5"}],"enisaIdVendor":[{"id":"61c42448-c53d-325a-9dfc-d36a0bd21e86","vendor":{"name":"nezhahq"}}],"enisaIdVulnerability":[{"id":"cb6527f7-6c94-39ff-b949-43b91d40acd7","vulnerability":{"id":"CVE-2026-59155","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.","datePublished":"Jul 10, 2026, 9:31:34 PM","dateUpdated":"Jul 13, 2026, 5:56:44 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-ww5p-j6cj-6mqq\nhttps://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e\nhttps://github.com/nezhahq/nezha/releases/tag/v2.2.5\n","enisa_id":"EUVD-2026-43108\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 28, 2026, 7:17:21 AM","vulnerabilityProduct":[{"id":"fbd3bb40-d1cc-3ba9-85f7-e1ac7cb70606","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"\u003c 2.2.5"}],"vulnerabilityVendor":[{"id":"bc1a5c67-2fe5-3ba3-ba1c-d647d1b6bd22","vendor":{"name":"nezhahq"}}]}}],"enisaIdAdvisory":[]}