{"id":"EUVD-2026-40374","revision":"0121a9e835d449ba884a69fe89caec00","records":[{"revision":"0121a9e835d449ba884a69fe89caec00","observedAt":"2026-11-05T12:40:20.596+00:00","statement":{"source":"euvd","id":"EUVD-2026-40374","aliases":["CVE-2026-58167","GHSA-27c6-wp53-387x"],"title":"Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) us…","description":"Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1,"severity":null}],"references":["https://github.com/ccfos/nightingale/releases/tag/v9.0.0-beta.2","https://github.com/ccfos/nightingale/issues/3173","https://github.com/ccfos/nightingale/pull/3175","https://github.com/ccfos/nightingale/commit/762819fbaa2350b73bce45bfaf6f8cf74b4abef8","https://www.vulncheck.com/advisories/nightingale-beta-2-datasource-credential-disclosure-to-low-privilege-users"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40374","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 30, 2026, 3:51:55 PM","dateUpdated":"Jul 14, 2026, 9:34:53 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-40374","identifiers":["EUVD-2026-40374","CVE-2026-58167","GHSA-27c6-wp53-387x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}