CVE-2026-59155

Katalog CVE

CVSS 6.9 · Medium EPSS 0,48%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor. Skor CVSS 4.0 6.9 (Medium) menurut github.com.

Deskripsi (NVD)

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Deferred

CVSS 4.0

6.9 (Medium), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e
• https://github.com/nezhahq/nezha/releases/tag/v2.2.5
• https://github.com/nezhahq/nezha/security/advisories/GHSA-ww5p-j6cj-6mqq