CVE-2026-58167

Name of the Vulnerable Software and Affected Versions Nightingale (n9e) versions prior to 9.0.0-beta.2

Description Authenticated users with low privileges (Standard role) can access full datasource configurations through the 'POST /api/n9e/datasource/list' endpoint. This occurs because the route lacks an admin authorization gate and the DatasourceFilter fails to redact secret fields. Consequently, the response serializes sensitive data within the settings, http, and auth objects, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, allowing unauthorized access to connected downstream systems.

Recommendations Update to version 9.0.0-beta.2 or later. Restrict access to the 'POST /api/n9e/datasource/list' endpoint to prevent low-privilege users from retrieving datasource configurations.