Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-58167Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users

Medium 6.5

In plain English

A medium-severity missing authorization in nightingale from ccfos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/ccfos/nightingale	no fix listed	GO-2026-6638
Go	github.com/ccfos/nightingale/v4	no fix listed	GO-2026-6638
Go	github.com/ccfos/nightingale/v5	no fix listed	GO-2026-6638
Go	github.com/ccfos/nightingale/v6	6.7.3-0.20260528033214-762819fbaa23	GHSA-27c6-wp53-387x
Go	github.com/ccfos/nightingale/v6	6.7.3-0.20260528033214-762819fbaa23	GO-2026-6638

Affected products (as reported)

Vendor	Product	Versions
ccfos	nightingale	0 – before 9.0.0-beta.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Release Notes release-notes
GitHub Issue technical-description
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/nightingale-beta-2-datasource-credential-disclosure-to-low-privilege-users third-party-advisory