Nezha Monitoring CVE-2026-59155

Exploitation requires a valid authenticated session on the Nezha instance - either an admin account or a personal access token (PAT) scoped to nezha:ddns:read (to extract DDNS provider credentials) or nezha:notification:read (to extract notification channel secrets including webhook tokens). No non-default configuration is required beyond having at least one DDNS provider or notification channel configured, which is the intended operational state of the platform. Exploitation is strictly limited to users who already hold valid, high-privilege credentials on the Nezha instance; unauthenticated external attackers cannot reach these endpoints. The limiting factor is the PR:H requirement: only those already granted admin or scoped PAT access can exploit this. In single-operator self-hosted deployments the real-world risk is reduced, but in team environments where PATs are distributed to multiple operators, any PAT holder gains access to all stored third-party secrets.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.9) accurately reflects that exploitation requires high-privilege authentication, substantially constraining the threat surface relative to unauthenticated flaws. Despite the Medium base score, the real-world confidentiality impact is significant because the credentials exposed are not scoped to Nezha itself - Cloudflare API tokens and TencentCloud SecretKeys can be leveraged to access and manipulate third-party cloud infrastructure entirely outside of the Nezha platform. The primary threat actor is an insider, a compromised admin account, or a PAT holder whose scope was intended as read-only. In multi-operator or team deployments where PATs are distributed, this represents a meaningful lateral-movement risk. No EPSS score was provided, and the product's niche self-hosted deployment footprint suggests low likelihood of automated or opportunistic exploitation. There is no CISA KEV listing and no known POC, consistent with a low urgency for external attackers but moderate urgency for organizations issuing PATs to multiple operators. The CVSS score slightly understates the downstream blast radius since harvested tokens extend attacker reach beyond the Nezha instance itself.

An operator with a PAT scoped to nezha:ddns:read issues a single authenticated GET request to /api/v1/ddns and receives a JSON array containing the full Cloudflare API token stored in Nezha. The operator then uses that token directly against the Cloudflare API to enumerate DNS zones and modify DNS records, enabling traffic redirection or subdomain takeover on infrastructure managed by the Nezha deployment owner - all without any access to Nezha's administrative interface.