CVE-2026-59155 nezhahq CVE debrief

Who should care

Users of Nezha Monitoring versions prior to 2.2.5 should be aware of this vulnerability and take immediate action to update their installations. This issue is particularly concerning for administrators who have integrated third-party services like Cloudflare, TencentCloud, Slack, Discord, or Telegram with their Nezha Monitoring setup.

Technical summary

The CVE-2026-59155 vulnerability in Nezha Monitoring versions prior to 2.2.5 exposed sensitive third-party API credentials through its API endpoints. Specifically, the GET /api/v1/ddns and GET /api/v1/notification endpoints returned full resource objects, including plaintext credentials for services like Cloudflare, TencentCloud, Slack, Discord, and Telegram. This issue was due to a lack of field-level redaction in the API responses. The vulnerability could be exploited by any authenticated admin or user with the nezha:ddns:read or nezha:notification:read scope, allowing them to obtain sensitive information through the listDDNS and listNotification handlers.

Defensive priority

High

Recommended defensive actions

• Update Nezha Monitoring to version 2.2.5 or later
• Review and rotate exposed third-party API credentials
• Restrict access to the listDDNS and listNotification handlers
• Implement additional monitoring for suspicious API activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about this vulnerability. The issue is fixed in Nezha Monitoring version 2.2.5. Users should update their installations and review their security configurations to prevent exploitation.

Official resources