Home

Description

Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.

PUBLISHED Reserved 2026-06-29 | Published 2026-06-30 | Updated 2026-07-14 | Assigner VulnCheck




MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

Missing Authorization

Product status

Default status
unaffected

Any version before 9.0.0-beta.2
affected

Credits

George Chen finder

References

github.com/ccfos/nightingale/releases/tag/v9.0.0-beta.2 (Release Notes) release-notes

github.com/ccfos/nightingale/issues/3173 (GitHub Issue) technical-description

github.com/ccfos/nightingale/pull/3175 (Fix PR) issue-tracking

github.com/...ommit/762819fbaa2350b73bce45bfaf6f8cf74b4abef8 (Fix Commit) patch

www.vulncheck.com/...ntial-disclosure-to-low-privilege-users third-party-advisory

cve.org (CVE-2026-58167)

nvd.nist.gov (CVE-2026-58167)

Download JSON