Information Disclosure in Parseable Notification-Target API Endpoints

CVE-2026-56783

What is CVE-2026-56783?

Parseable versions prior to 2.9.2 are susceptible to an information disclosure vulnerability affecting the notification-target API endpoints. This vulnerability allows authenticated users, including those with low-privilege reader roles, to access webhook tokens and basic-auth credentials in cleartext. The issue arises from the commented-out secret-masking functionality. By querying the GET /api/v1/targets endpoint or related endpoints, attackers can recover sensitive credentials and internal endpoint URLs for all configured notification targets, posing a significant risk to system security.

References