Description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nezhahq | nezha | < 2.2.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/nezhahq/nezha | < 2.2.5 | 2.2.5 | GHSA-ww5p-j6cj-6mqq |
| Go | github.com/nezhahq/nezha | all versions | — | GO-2026-5832 |