Data Exposure Vulnerability in Nightingale by CCFOS

CVE-2026-58167

What is CVE-2026-58167?

Nightingale versions before 9.0.0-beta.2 have a vulnerability that allows low-privilege users to access sensitive datasource configurations. This exposure includes plaintext database passwords, HTTP bearer tokens, basic-auth passwords, and mTLS client keys through the insecure endpoint POST /api/n9e/datasource/list. The lack of an admin authorization gate on this route, combined with the failure to redact secret fields in the response, leaves critical credentials exposed and may enable unauthorized access to downstream systems.

References