---
id: "CVE-2026-58167"
kind: "vulnerability"
aliases: ["CVE-2026-58167", "GHSA-27c6-wp53-387x", "GO-2026-6638"]
title: "Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale"
severity: "high"
cvss: 7.1
epss: 0.00415
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/ccfos/nightingale", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/ccfos/nightingale/v4", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/ccfos/nightingale/v5", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/ccfos/nightingale/v6", "fixed": ["6.7.3-0.20260528033214-762819fbaa23"], "affected": "< 6.7.3-0.20260528033214-762819fbaa23", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "monitoring", "nightingale", "package", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-06-30T17:16:23+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:45:55+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6638", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-58167", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58167", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale

Nightingale monitoring versions before 9.0.0-beta.2 return full datasource configurations, including plaintext database passwords, HTTP bearer tokens, basic-auth passwords and mTLS client keys, to any logged-in user with the Standard role via POST /api/n9e/datasource/list. An attacker with a low-privilege account can reuse those credentials to access the downstream databases and HTTP services that Nightingale connects to.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/ccfos/nightingale affected all versions fixed ?
- go:github.com/ccfos/nightingale/v4 affected all versions fixed ?
- go:github.com/ccfos/nightingale/v5 affected all versions fixed ?
- go:github.com/ccfos/nightingale/v6 affected < 6.7.3-0.20260528033214-762819fbaa23 fixed 6.7.3-0.20260528033214-762819fbaa23

## How to check

Check whether the Go module github.com/ccfos/nightingale (or /v5, /v6) is in go.mod and at a version below the fix.
As a Standard-role user, POST /api/n9e/datasource/list and look for password, token or key fields in the response.

## Fix

Upgrade github.com/ccfos/nightingale/v6 to 6.7.3-0.20260528033214-762819fbaa23 or later; the govuln record gives no fixed version for the unversioned and /v4 or /v5 paths.
Rotate datasource passwords, bearer tokens, basic-auth passwords and mTLS client keys that were visible to Standard-role users.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6638
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-58167
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58167

## From the sources

Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_