Executive brief
Nezha Monitoring, a tool used for managing and monitoring servers and websites, was found to expose sensitive third-party credentials in its management API. An authorized administrator or a user with specific API tokens could view plaintext secrets, including Cloudflare tokens, Slack webhooks, and Telegram bot keys, which are normally used to integrate the dashboard with other services. If exploited, an attacker could use these stolen credentials to modify DNS records or send unauthorized messages through the victim's communication channels.
Technical details
An information exposure vulnerability (CWE-200) exists in Nezha Monitoring's 'GET /api/v1/ddns' and 'GET /api/v1/notification' endpoints. The application returns full resource objects from the database without field-level redaction, leaking sensitive fields such as 'access_secret', 'url', and 'RequestHeader'. This allows any authenticated administrator or Personal Access Token (PAT) with 'nezha:ddns:read' or 'nezha:notification:read' scopes to retrieve plaintext Cloudflare API tokens, TencentCloud SecretKeys, and webhook URLs for Slack, Discord, and Telegram. The vulnerability was addressed in version 2.2.5 by implementing redaction in the API response handlers.
Affected products
- nezhahq Nezha Monitoring < 2.2.5
Timeline
- 2026-06-20: patched: Fix committed and version 2.2.5 released.
- 2026-07-10: advisory: GHSA and NVD advisory published.