CVE-2026-56783: Parseable Information Disclosure Flaw

CVE-2026-56783 Overview

CVE-2026-56783 is an information disclosure vulnerability in Parseable versions before 2.9.2. The flaw resides in the notification-target API endpoints, which return webhook tokens and basic-auth credentials in cleartext. The root cause is commented-out secret-masking functionality in the /targets handler. Any authenticated user holding the GetAlert action, including low-privilege reader roles, can query GET /api/v1/targets and recover credentials plus internal endpoint URLs for every configured notification target. This weakness is tracked as [CWE-522: Insufficiently Protected Credentials].

Critical Impact
Low-privileged authenticated users can harvest webhook tokens, basic-auth credentials, and internal endpoint URLs for all notification targets, enabling lateral movement into Slack, PagerDuty, and other integrated systems.

Affected Products

Parseable versions prior to 2.9.2
Parseable notification-target API (/api/v1/targets)
Slack, webhook, and Other target integrations configured within Parseable

Discovery Timeline

2026-06-29 - CVE-2026-56783 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-56783

Vulnerability Analysis

Parseable is an open-source log analytics and observability platform. It supports alert routing to external notification targets such as Slack, generic webhooks, and other integrations. Each target stores an endpoint URL and, in many cases, an authentication token or basic-auth header used to reach the destination service.

Before version 2.9.2, the target retrieval handler returned the raw Target struct in the JSON response instead of the masked variant. The mask() method that redacted webhook endpoints and header credentials was still present in the source but the call site was commented out. As a result, calls to GET /api/v1/targets and related endpoints emitted secrets verbatim to any caller passing the GetAlert authorization check.

The GetAlert action is granted to reader-tier roles, so the exposure is not restricted to administrators. An attacker with the lowest-tier account can enumerate every target and reuse the exfiltrated credentials against the downstream systems.

Root Cause

The root cause is a regression in src/handlers/http/targets.rs where the response serialization was changed to return the unmasked target object. The masking helper in src/alerts/target.rs was bypassed, allowing Slack webhook URLs, Other webhook endpoints, and custom authentication headers to appear as plaintext in API responses.

Attack Vector

Exploitation requires network reachability to the Parseable HTTP API and valid credentials with any role that includes the GetAlert action. The attacker sends an authenticated GET request to the targets endpoint and parses the JSON response for endpoint and headers fields containing webhook tokens or Authorization values.

rust

// Patch: src/alerts/target.rs - restore and harden credential masking (#1698)
pub fn mask(self) -> Value {
    match self.target {
        TargetType::Slack(slack_web_hook) => {
            json!({
                "name": self.name,
                "type": "slack",
                "endpoint": format!("{}://********", slack_web_hook.endpoint.scheme()),
                "id": self.id
            })
        }
        TargetType::Other(other_web_hook) => {
            let safe_headers: HashMap<String, String> = other_web_hook
                .headers
                .into_keys()
                .map(|k| (k, "********".to_string()))
                .collect();
            json!({
                // ... remaining fields returned with masked headers
            })
        }
    }
}

// Patch: src/handlers/http/targets.rs
// Before: Ok(web::Json(target))
// After:
Ok(web::Json(target.mask()))

Source: Parseable commit f307c49

Detection Methods for CVE-2026-56783

Indicators of Compromise

Unexpected authenticated GET requests to /api/v1/targets or per-target endpoints from reader-tier accounts.
Outbound traffic from third-party systems (Slack, PagerDuty, custom webhooks) originating from IP addresses unrelated to the Parseable deployment.
Reuse of webhook tokens or basic-auth credentials outside of Parseable's egress network ranges.

Detection Strategies

Audit Parseable access logs for requests to /api/v1/targets* and correlate the requesting user role against GetAlert grants.
Alert on any reader or non-administrative user querying notification target endpoints.
Compare the Parseable version reported by the deployment against 2.9.2 to identify vulnerable instances.

Monitoring Recommendations

Enable HTTP request logging on the Parseable API layer and forward logs to a centralized analytics platform.
Monitor downstream webhook receivers for authentication events sourced from unexpected origins.
Track role assignments and privilege changes that grant the GetAlert action.

How to Mitigate CVE-2026-56783

Immediate Actions Required

Upgrade Parseable to version 2.9.2 or later, which reinstates and hardens the mask() call in the targets handler.
Rotate every webhook token, basic-auth credential, and API key configured in Parseable notification targets.
Review Parseable role definitions and revoke GetAlert from any account that does not require alert visibility.
Audit downstream services (Slack, PagerDuty, custom webhooks) for unauthorized use of leaked credentials.

Patch Information

The fix is included in Parseable Release v2.9.2 via Pull Request #1698 and tracked in Issue #1693. Additional context is available in the VulnCheck Advisory on Credential Exposure.

Workarounds

Restrict network access to the Parseable API to trusted operators until the upgrade completes.
Temporarily remove notification targets that hold high-value credentials and reconfigure them after patching and rotation.
Enforce least-privilege role assignments so only administrators retain the GetAlert action.

bash

# Verify installed Parseable version and upgrade via container image
docker inspect parseable/parseable --format '{{.Config.Image}}'
docker pull parseable/parseable:v2.9.2
docker stop parseable && docker rm parseable
docker run -d --name parseable \
  -p 8000:8000 \
  -v parseable-data:/parseable/data \
  parseable/parseable:v2.9.2 parseable local-store