Nezha Dashboard credential exposure in DDNS and Notification APIs

Executive brief

Nezha Dashboard, a server monitoring tool, contains a vulnerability where administrative interfaces for DDNS and notifications reveal sensitive third-party credentials in plain text. An attacker with administrative access or a leaked API token can view all stored secrets, including Cloudflare tokens, Slack webhooks, and Telegram bot keys. This could allow an unauthorized party to modify DNS records or send messages as the organization's automated bots.

Technical details

The `GET /api/v1/ddns` and `GET /api/v1/notification` endpoints in Nezha Dashboard fail to redact sensitive fields before serializing resource objects to JSON. The `listDDNS` and `listNotification` handlers copy internal structs directly to the response, exposing fields such as `AccessSecret`, `WebhookURL`, and `RequestHeader`. An authenticated attacker with administrative privileges or a Personal Access Token (PAT) with read scopes can exfiltrate Cloudflare API tokens, TencentCloud SecretKeys, and bot tokens for Slack, Discord, or Telegram. The vulnerability is present in versions prior to 2.2.5 and was addressed by introducing field-level redaction or separate response structs.

Affected products

• nezhahq Nezha Dashboard < 2.2.5

Timeline

• 2026-06-20: disclosed
• 2026-06-26: advisory: GitHub Advisory published
• 2026-06-26: patched: Fixed in version 2.2.5

References

• https://api.github.com/users/sondt99
• https://github.com/sondt99
• https://api.github.com/users/sondt99/gists%7B/gist_id%7D
• https://api.github.com/users/sondt99/repos
• https://avatars.githubusercontent.com/u/87920408?v=4
• https://api.github.com/users/sondt99/events%7B/privacy%7D