CVE-2026-58167

The record

Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.

Affected packages

Related vulnerabilities

• CVE-2026-55147 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
• CVE-2026-55146 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
• CVE-2026-62967 ZTNET is a ZeroTier web UI for private controllers with multiuser and organization… CWE-862
• CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. CWE-862
• CVE-2026-78403 Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel… CWE-862
• CVE-2026-62301 MyTube is a self-hosted downloader and player for several video websites. CWE-862
• CVE-2026-119337 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. CWE-862
• CVE-2026-116245 libpq looks a connection service up in the service file of the operating-system account… CWE-862