CVE-2026-58167: Ccfos Nightingale

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.

Affected products

• Ccfos Nightingale: before 9.0.0-beta.2 (fixed in 9.0.0-beta.2)

Published 2026-06-30. Last modified 2026-07-14.