{"id":"EUVD-2026-40374","enisaUuid":"5061faa7-4058-366a-b35f-7bce31d2855f","description":"Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.","datePublished":"Jun 30, 2026, 3:51:55 PM","dateUpdated":"Jul 14, 2026, 9:34:53 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/ccfos/nightingale/releases/tag/v9.0.0-beta.2\nhttps://github.com/ccfos/nightingale/issues/3173\nhttps://github.com/ccfos/nightingale/pull/3175\nhttps://github.com/ccfos/nightingale/commit/762819fbaa2350b73bce45bfaf6f8cf74b4abef8\nhttps://www.vulncheck.com/advisories/nightingale-beta-2-datasource-credential-disclosure-to-low-privilege-users\n","aliases":"CVE-2026-58167\nGHSA-27c6-wp53-387x\n","assigner":"VulnCheck","epss":0.42,"enisaIdProduct":[{"id":"31d495e4-1c74-3689-995b-a948ffe77c97","product":{"name":"nightingale","vendor":{"name":"ccfos"}},"product_version":"0 \u003c9.0.0-beta.2"}],"enisaIdVendor":[{"id":"5c8a86de-2a66-3925-8cd9-57fa15c96a8a","vendor":{"name":"ccfos"}}],"enisaIdVulnerability":[{"id":"35624e55-095a-3a4a-b3e2-ecf553a2e79a","vulnerability":{"id":"CVE-2026-58167","description":"Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.","datePublished":"Jun 30, 2026, 3:51:55 PM","dateUpdated":"Jul 14, 2026, 9:34:53 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/ccfos/nightingale/releases/tag/v9.0.0-beta.2\nhttps://github.com/ccfos/nightingale/issues/3173\nhttps://github.com/ccfos/nightingale/pull/3175\nhttps://github.com/ccfos/nightingale/commit/762819fbaa2350b73bce45bfaf6f8cf74b4abef8\nhttps://www.vulncheck.com/advisories/nightingale-beta-2-datasource-credential-disclosure-to-low-privilege-users\n","enisa_id":"EUVD-2026-40374\n","assigner":"VulnCheck","epss":0.42,"dataProcessed":"Nov 5, 2026, 7:18:05 AM","vulnerabilityProduct":[{"id":"758748ee-03b6-3ba9-be36-1ee0fa3d1dee","product":{"name":"nightingale","vendor":{"name":"ccfos"}},"product_version":"0 \u003c9.0.0-beta.2"}],"vulnerabilityVendor":[{"id":"576473ed-5c78-3845-9787-3990b21e5668","vendor":{"name":"ccfos"}}]}},{"id":"77ab5e24-7017-3aa4-b631-843d23a107cb","vulnerability":{"id":"GHSA-27c6-wp53-387x","description":"Nightingale exposes datasource credentials to low-privilege users","datePublished":"Jun 30, 2026, 6:31:38 PM","dateUpdated":"Oct 2, 2026, 6:28:18 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-58167\nhttps://github.com/ccfos/nightingale/issues/3173\nhttps://github.com/ccfos/nightingale/pull/3175\nhttps://github.com/ccfos/nightingale/commit/762819fbaa2350b73bce45bfaf6f8cf74b4abef8\nhttps://github.com/ccfos/nightingale\nhttps://github.com/ccfos/nightingale/releases/tag/v9.0.0-beta.2\nhttps://www.vulncheck.com/advisories/nightingale-beta-2-datasource-credential-disclosure-to-low-privilege-users\n","enisa_id":"EUVD-2026-40374\n","aliases":"CVE-2026-58167\nGHSA-27c6-wp53-387x\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}