{"id":"CVE-2026-58167","kind":"vulnerability","aliases":["CVE-2026-58167","GHSA-27c6-wp53-387x","GO-2026-6638"],"related":[],"title":"Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale","description":"Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.","summary":"Nightingale monitoring versions before 9.0.0-beta.2 return full datasource configurations, including plaintext database passwords, HTTP bearer tokens, basic-auth passwords and mTLS client keys, to any logged-in user with the Standard role via POST /api/n9e/datasource/list. An attacker with a low-privilege account can reuse those credentials to access the downstream databases and HTTP services that Nightingale connects to.","severity":"high","cvss":7.1,"epss":0.00415,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/ccfos/nightingale","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/ccfos/nightingale/v4","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/ccfos/nightingale/v5","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/ccfos/nightingale/v6","fixed":["6.7.3-0.20260528033214-762819fbaa23"],"affected":"< 6.7.3-0.20260528033214-762819fbaa23","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","monitoring","nightingale","package","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"Check whether the Go module github.com/ccfos/nightingale (or /v5, /v6) is in go.mod and at a version below the fix.\nAs a Standard-role user, POST /api/n9e/datasource/list and look for password, token or key fields in the response.","fix":"Upgrade github.com/ccfos/nightingale/v6 to 6.7.3-0.20260528033214-762819fbaa23 or later; the govuln record gives no fixed version for the unversioned and /v4 or /v5 paths.\nRotate datasource passwords, bearer tokens, basic-auth passwords and mTLS client keys that were visible to Standard-role users.","status":"open","published_at":"2026-06-30T17:16:23+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:45:55+00:00","updated_at":"2026-10-23T21:45:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:45:55Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/ccfos/nightingale/v6 to 6.7.3-0.20260528033214-762819fbaa23 or later; the govuln record gives no fixed version for the unversioned and /v4 or /v5 paths.\nRotate datasource passwords, bearer tokens, basic-auth passwords and mTLS client keys that were visible to Standard-role users.","reach":"network","impact":"high","summary":"Nightingale monitoring versions before 9.0.0-beta.2 return full datasource configurations, including plaintext database passwords, HTTP bearer tokens, basic-auth passwords and mTLS client keys, to any logged-in user with the Standard role via POST /api/n9e/datasource/list. An attacker with a low-privilege account can reuse those credentials to access the downstream databases and HTTP services that Nightingale connects to.","category":"package","who_cares":["nightingale","self-hosted","go","monitoring"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privilege users read datasource database passwords and tokens, reaching downstream systems.","analyst_note":"Confirm which module paths (plain, /v4, /v5) are actually vulnerable and their fixed versions at https://pkg.go.dev/vuln/GO-2026-6638, since the govuln record lists no fix for them.","how_to_check":"Check whether the Go module github.com/ccfos/nightingale (or /v5, /v6) is in go.mod and at a version below the fix.\nAs a Standard-role user, POST /api/n9e/datasource/list and look for password, token or key fields in the response.\nunknown for any other check the sources do not describe.","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000633,"input_tokens":3147,"output_tokens":637,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A,26A '-58167':16A,27A '-6638':24A '/api/n9e/datasource/list':84B,144C '/ccfos/nightingale':13A,30A '/ccfos/nightingale/v4':33A '/ccfos/nightingale/v5':36A '/ccfos/nightingale/v6':39A '27c6':19A '387x':21A '9.0.0':51B,111C 'access':98B,190C 'account':92B 'admin':151C 'attack':86B 'auth':66B,127C,179C 'authent':135C 'author':152C 'basic':65B,126C 'basic-auth':64B,125C 'bear':175C 'bearer':62B,122C 'beta.2':52B,112C 'client':70B,131C 'configur':56B,116C 'connect':107B,193C 'credenti':4A,96B,188C 'cve':14A,25A 'databas':59B,101B,119C 'datasourc':3A,55B,115C,157C 'datasourcefilt':165C 'disclos':187C 'downstream':100B,194C 'enabl':189C 'expos':2A,113C 'field':170C 'full':54B,114C 'gate':153C 'ghsa':18A 'ghsa-27c6-wp53-387x':17A 'github.com':12A,29A,32A,35A,38A 'github.com/ccfos/nightingale':11A,28A 'github.com/ccfos/nightingale/v4':31A 'github.com/ccfos/nightingale/v5':34A 'github.com/ccfos/nightingale/v6':37A 'go':22A,40B 'host':46B 'http':61B,103B,121C,124C,177C 'includ':57B,117C 'key':71B,132C 'log':75B 'logged-in':74B 'low':7A,90B,137C 'low-privileg':6A,89B,136C 'monitor':41B,48B 'mtls':69B,130C 'mutat':158C 'n9e':109C 'nightingal':1A,42B,47B,106B,108C 'object':180C 'open':163C 'open-sourc':162C 'packag':43B 'password':60B,67B,120C,128C 'plaintext':58B,118C 'post':83B,143C 'privileg':8A,91B,138C 'redact':168C 'regist':148C 'respons':185C 'return':53B 'reus':94B 'role':81B,140C 'rout':146C,159C 'secret':169C,174C 'secret-bear':173C 'self':45B 'self-host':44B 'serial':182C 'servic':104B 'set':176C 'sibl':156C 'sourc':164C 'standard':80B,139C 'system':195C 'token':63B,123C 'unlik':154C 'user':9A,77B,141C 'version':49B 'via':82B 'without':149C 'wp53':20A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-30T17:16:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6638","url":"https://pkg.go.dev/vuln/GO-2026-6638","severity":null,"published_at":"2026-10-07T14:10:14+00:00","modified_at":"2026-10-07T14:10:14+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-58167","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58167","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-58167","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58167","severity":null,"published_at":"2026-06-30T17:16:23+00:00","modified_at":"2026-07-14T22:17:27+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}