# CVE-2026-59155: Nezha Monitoring plaintext credential exposure in DDNS and Notification APIs

Source: https://junglewise.ai/threats/cve-2026-59155-nezha-monitoring-plaintext-credential-exposure-in-ddns-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-59155 · Severity: medium · CVSS 4 · Published 2026-07-10

Nezha Monitoring, a tool used for managing and monitoring servers and websites, was found to expose sensitive third-party credentials in its management API. An authorized administrator or a user with specific API tokens could view plaintext secrets, including Cloudflare tokens, Slack webhooks, and Telegram bot keys, which are normally used to integrate the dashboard with other services. If exploited, an attacker could use these stolen credentials to modify DNS records or send unauthorized messages through the victim's communication channels.

Technologies: [github.com/nezhahq/nezha (Go)](https://junglewise.ai/threats/technologies/github-com-nezhahq-nezha), [NezhaHQ Nezha Monitoring](https://junglewise.ai/threats/technologies/nezha). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [NezhaHQ](https://junglewise.ai/threats/vendors/nezhahq).

## Quick answers

**Is CVE-2026-59155 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59155 being exploited in the wild.

**How severe is CVE-2026-59155?** Medium severity, with a CVSS score of 4, published 10 July 2026.

**Which products and versions are affected?** github.com/nezhahq/nezha (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.2.5; NezhaHQ Nezha Monitoring < 2.2.5.

**Is there a fix for CVE-2026-59155?** Yes. github.com/nezhahq/nezha (Go): upgrade to 2.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59155 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59155?** Check whether you run github.com/nezhahq/nezha (Go) or NezhaHQ Nezha Monitoring at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/nezhahq/nezha (Go): upgrade to 2.2.5 or later

  ```sh
  go get github.com/nezhahq/nezha@v2.2.5
  ```


## Technical details

An information exposure vulnerability (CWE-200) exists in Nezha Monitoring's 'GET /api/v1/ddns' and 'GET /api/v1/notification' endpoints. The application returns full resource objects from the database without field-level redaction, leaking sensitive fields such as 'access_secret', 'url', and 'RequestHeader'. This allows any authenticated administrator or Personal Access Token (PAT) with 'nezha:ddns:read' or 'nezha:notification:read' scopes to retrieve plaintext Cloudflare API tokens, TencentCloud SecretKeys, and webhook URLs for Slack, Discord, and Telegram. The vulnerability was addressed in version 2.2.5 by implementing redaction in the API response handlers.

## Affected products

- nezhahq Nezha Monitoring < 2.2.5

## Identifiers

- CVE-2026-59155
- GHSA-ww5p-j6cj-6mqq
- GO-2026-5832

## Timeline

- 2026-06-20: patched: Fix committed and version 2.2.5 released.
- 2026-07-10: advisory: GHSA and NVD advisory published.

## References

- [https://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e](https://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e)
- [https://github.com/nezhahq/nezha/releases/tag/v2.2.5](https://github.com/nezhahq/nezha/releases/tag/v2.2.5)
- [https://github.com/nezhahq/nezha/security/advisories/GHSA-ww5p-j6cj-6mqq](https://github.com/nezhahq/nezha/security/advisories/GHSA-ww5p-j6cj-6mqq)

## Related threats

- [Nezha monitoring dashboard denial of service via service deletion race](https://junglewise.ai/threats/cve-2026-100394-nezha-monitoring-whole-instance-dos-in-nezha-dashboard-a-member)
- [Nezha Host header injection in OAuth2 redirect endpoint](https://junglewise.ai/threats/cve-2026-101090-nezha-2-2-3-contains-a-host-header-injection-regression-in-the)
- [Nezha OAuth2 redirect_uri Host header injection regression](https://junglewise.ai/threats/nezha-oauth2-redirect-uri-host-header-injection-regression-331e924a)
- [Nezha Monitoring insufficient stream authorization in websocket endpoints](https://junglewise.ai/threats/cve-2026-62283-nezha-monitoring-insufficient-stream-authorization-in-websocket)
- [Nezha Monitoring Host Header Injection in OAuth2 callback](https://junglewise.ai/threats/cve-2026-53523-nezha-monitoring-host-header-injection-in-oauth2-callback)