CVE-2026-58167: Nightingale Credential Disclosure via Unprotected Datasource API

Technical summary

CVE-2026-58167 is an authorization bypass and sensitive information disclosure flaw in Nightingale versions before 9.0.0-beta.2. The POST /api/n9e/datasource/list endpoint does not enforce administrative authorization checks, allowing any authenticated user with the Standard role to request and receive the full serialization of all datasource objects. The vulnerability exists at two layers: the route itself lacks role-based access control (RBAC) guards that sibling mutation endpoints enforce, and the DatasourceFilter in the open-source codebase does not redact the settings, http, and auth object fields that contain plaintext credentials. When these objects are marshaled to JSON and returned, they expose database connection strings with credentials, HTTP Bearer tokens, Basic Authentication passwords, and mTLS client certificates.

Business impact

The disclosure of datasource credentials significantly expands the blast radius of a compromised low-privilege account. Standard users or attackers using stolen standard credentials can pivot to backend infrastructure—databases, Kubernetes clusters, cloud storage, and third-party monitoring services—with the same privileges as the Nightingale platform itself. This violates the principle of least privilege and can enable lateral movement, data exfiltration, or infrastructure manipulation. Organizations relying on role separation between the monitoring platform and managed systems lose that security boundary. The impact is particularly acute in environments where Nightingale monitors production systems or holds credentials for high-value targets.

Affected systems

Nightingale (n9e) versions prior to 9.0.0-beta.2 are vulnerable. The issue is present in the open-source project and any deployments running affected versions. Both self-hosted and containerized installations are exposed if not patched. The vulnerability requires an authenticated account (no unauthenticated access), but does not require administrative privileges, making it exploitable by a broader class of users and by attackers who have obtained or created standard-level credentials.

Exploitability

Exploitation is straightforward: an attacker with valid Standard-role credentials (or a compromised low-privilege account) can make a single POST request to /api/n9e/datasource/list and parse the JSON response to extract all stored credentials. No special tools, race conditions, or environment-specific setup are required. The vulnerability is not listed in the CISA KEV catalog, but the attack surface is wide—any organization using Nightingale with federated identity, SSO, or a high number of low-privilege users increases the likelihood of credential compromise or malicious insider abuse. Once obtained, the disclosed credentials are immediately actionable against downstream systems.

Remediation

Upgrade Nightingale to version 9.0.0-beta.2 or later. This version introduces proper authorization enforcement on the datasource list endpoint and redaction of sensitive fields in API responses. Organizations unable to upgrade immediately should restrict API access via network controls (IP allowlisting, WAF rules), enforce strong authentication and multi-factor authentication to reduce the chance of low-privilege credential compromise, and audit datasource configurations to identify which secrets are at highest risk of abuse.

Patch guidance

Verify the vendor advisory for the exact version number (9.0.0-beta.2 or final release) and deployment method (container image tags, package repositories, or source builds). Apply patches to all Nightingale instances, including development and staging environments, as they may host credentials for production systems. Test the patch in a non-production environment first to confirm API behavior does not regress. After patching, rotate all datasource credentials that were stored in Nightingale prior to the patch application, as they should be treated as compromised.

Detection guidance

In pre-patch environments, monitor for POST requests to /api/n9e/datasource/list from low-privilege or Standard-role accounts. Successful requests followed by credential usage patterns in downstream systems (database login anomalies, API token usage from unexpected sources, mTLS certificate activity) may indicate exploitation. Log all API calls to datasource endpoints and alert on requests from accounts that do not typically access datasource configurations. Correlate Nightingale authentication logs with subsequent access logs on connected backend systems to detect lateral movement.

Why prioritize this

Although CVSS 6.5 (Medium) reflects that exploitation requires authentication, the vulnerability fundamentally breaks credential segmentation in the monitoring stack. The ability for low-privilege users to obtain high-privilege secrets in connected systems elevates real-world risk beyond the numeric score. Organizations with many standard users, high-value backend systems, or compliance requirements for role separation should prioritize this as a high-business-impact issue. The fix is available and straightforward; delay increases exposure window.

Risk score, explained

CVSS 3.1 score of 6.5 reflects: network-accessible API (AV:N), low complexity (AC:L), required authentication but low privilege (PR:L), no user interaction (UI:N), single security domain (S:U), high confidentiality impact (C:H), and no integrity or availability impact (I:N/A:N). The score does not account for secondary impact on downstream systems or the organizational cost of credential rotation, which the business context should weigh during prioritization.

Frequently asked questions