All vulnerabilities
CVE-2026-58167GHSA-27c6-wp53-387xGO-2026-6638

github.com/ccfos/nightingale/v6: Nightingale exposes datasource credentials to low-privilege users

ccfos github.com/ccfos/nightingale/v6goLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 34% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.7.3-0.20260528033214-762819fbaa23Also 9.0.0-beta.2GitHub
Published30 Jun 2026Updated 7 Oct 2026CVE List

What fixes it

  • 6.7.3-0.20260528033214-762819fbaa23github.com/ccfos/nightingale/v6, goGitHubgo get github.com/ccfos/nightingale/v6@v6.7.3-0.20260528033214-762819fbaa23
  • 9.0.0-beta.2nightingaleCVE List
  • 6.7.3-0.20260528033214-762819fbaa23github.com/ccfos/nightingale/v6, GoOSVgo get github.com/ccfos/nightingale/v6@v6.7.3-0.20260528033214-762819fbaa23

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.

Text from CVE List

Affected versions 3

  • github.com/ccfos/nightingale/v6, go< 6.7.3-0.20260528033214-762819fbaa23GitHub
  • nightingaleaffected: all versions before 9.0.0-beta.2CVE List
  • github.com/ccfos/nightingale/v6, Gofrom first release, fixed in 6.7.3-0.20260528033214-762819fbaa23OSV

References 7