Is there a patch available for EUVD-2026-43108?

Yes, a patch is available for EUVD-2026-43108. Update the affected software to the latest version immediately.

Nezha Monitoring EUVD-2026-43108

Q: What is the CVSS score of EUVD-2026-43108?

EUVD-2026-43108 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-59155 MEDIUM

Information Exposure (CWE-200)

2026-07-10 GitHub_M

Information Disclosure Nezha Nezhahq

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.9 MEDIUM

Network-accessible API requires high privileges (PR:H); full plaintext credential disclosure warrants C:H; no integrity or availability impact from the disclosure itself.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 23:02 EUVD

Analysis Generated

Jul 10, 2026 - 22:23 vuln.today

DescriptionCVE.org

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.

AnalysisAI

Nezha Monitoring versions prior to 2.2.5 expose stored third-party API credentials in plaintext through two listing API endpoints to any authenticated admin or PAT holder with read-scoped access. The GET /api/v1/ddns and GET /api/v1/notification handlers serialize full database objects - including Cloudflare API tokens, TencentCloud SecretKeys, and Slack, Discord, and Telegram webhook URLs with embedded bot tokens - without any field-level redaction, enabling a single API call to harvest all configured credentials. No public exploit has been identified at time of analysis, and a vendor-released patch is available in v2.2.5.

Technical ContextAI

Nezha Monitoring is a self-hostable, Go-based server and website monitoring and O&M (operations and maintenance) platform identified by CPE cpe:2.3:a:nezhahq:nezha:*:*:*:*:*:*:*:*. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), arising from the listDDNS and listNotification API handlers serializing full database record objects directly into HTTP JSON responses without masking or excluding credential fields. Rather than returning only non-sensitive metadata (e.g., provider name, label), both handlers return the complete stored configuration object, which includes raw API keys, secret keys, and full webhook URLs with embedded authentication tokens. This design flaw means that read-only list permissions are functionally equivalent to credential-read permissions - a separation-of-privilege failure common in systems where credential storage and operational configuration are not architecturally decoupled.

RemediationAI

Upgrade Nezha Monitoring to v2.2.5, which introduces field-level redaction for credential fields in the listDDNS and listNotification API responses. The patch commit is at https://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e and the release at https://github.com/nezhahq/nezha/releases/tag/v2.2.5. As an immediate pre-patch compensating control, rotate all third-party credentials stored in Nezha - revoke and reissue Cloudflare API tokens, TencentCloud SecretKeys, and all Slack, Discord, and Telegram webhook URLs - since any PAT holder with read scope may have already obtained them. Additionally, audit all issued PATs and revoke those holding nezha:ddns:read or nezha:notification:read scope that are not operationally required, reducing the window of exposure until patching is complete. Network-level controls such as IP allowlisting for the Nezha API are a useful defense-in-depth measure but do not prevent exploitation by legitimate internal users.