EUVD-2026-40374
GHSA-27c6-wp53-387x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API reachable with low complexity, but a valid low-privilege account is required so PR:L; impact is pure credential confidentiality (C:H) with no integrity or availability effect on Nightingale.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.
AnalysisAI
Credential disclosure in Nightingale (n9e) before 9.0.0-beta.2 lets any authenticated Standard-role (low-privilege) user retrieve full datasource configurations via POST /api/n9e/datasource/list, exposing plaintext database passwords, HTTP bearer tokens, basic-auth passwords, and mTLS client keys. Reported by VulnCheck and fixed in v9.0.0-beta.2, this missing-authorization flaw effectively turns a read-only monitoring account into a pivot point against every connected downstream system. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Nightingale is an open-source observability/alerting platform (CPE cpe:2.3:a:ccfos:nightingale) that stores connection settings for the data sources it queries (Prometheus, databases, HTTP endpoints, etc.), including the secrets needed to authenticate to them. The root cause is CWE-862 (Missing Authorization): the datasource list route is registered without the admin authorization gate that protects the sibling datasource mutation (create/update/delete) routes, an inconsistent access-control configuration. Compounding this, the open-source DatasourceFilter does not redact secret fields, so the full settings, http, and auth objects - containing DB passwords, bearer tokens, basic-auth credentials, and mTLS client keys - are serialized verbatim into the API response rather than being stripped or masked.
RemediationAI
Vendor-released patch: 9.0.0-beta.2 - upgrade Nightingale to v9.0.0-beta.2 or later, which adds the missing admin authorization gate on the datasource list route (see https://github.com/ccfos/nightingale/releases/tag/v9.0.0-beta.2 and commit 762819fbaa2350b73bce45bfaf6f8cf74b4abef8). If an immediate upgrade is not possible, restrict who can authenticate to Nightingale by auditing and minimizing Standard-role accounts and placing the API behind a network/reverse-proxy ACL that blocks /api/n9e/datasource/list for non-admin users (trade-off: a proxy rule is brittle and may break legitimate admin tooling that relies on the endpoint). Because the credentials are already exposed, treat any pre-patch period as a disclosure event and rotate all datasource secrets - database passwords, HTTP bearer tokens, basic-auth passwords, and mTLS client keys - on the connected downstream systems after patching; rotation is mandatory since upgrading alone does not invalidate credentials an attacker may have already harvested.
More in Nightingale
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today