CVE-2026-58167: Nightingale Information Disclosure Flaw

CVE-2026-58167 Overview

CVE-2026-58167 is a missing authorization vulnerability [CWE-862] in Nightingale (n9e), an open-source cloud-native monitoring platform. Versions before 9.0.0-beta.2 expose full datasource configurations through the POST /api/n9e/datasource/list endpoint. Any authenticated user with the low-privilege Standard role can retrieve plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys. The route lacks an administrative authorization gate, and the open-source DatasourceFilter does not redact secret fields before serialization.

Critical Impact
Low-privilege authenticated users can harvest credentials for every connected datasource, enabling lateral movement into downstream databases, HTTP APIs, and mTLS-protected services.

Affected Products

Nightingale (n9e) versions prior to 9.0.0-beta.2
Deployments exposing the /api/n9e/datasource/list route to Standard role users
Any downstream systems whose credentials are stored in Nightingale datasource configurations

Discovery Timeline

2026-06-30 - CVE-2026-58167 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58167

Vulnerability Analysis

Nightingale registers datasource routes in center/router/router_datasource.go. Mutation routes for datasources are guarded by administrator authorization checks, but the list route POST /api/n9e/datasource/list is not. The handler invokes models.GetDatasourcesGetsBy and passes the results through DatasourceCache.DatasourceFilter, which only filters datasource visibility by user scope. It does not strip secret material from the returned objects.

As a result, the JSON response includes the settings, http, and auth objects with their secret-bearing fields intact. These fields contain credentials Nightingale uses to query downstream systems such as Prometheus, MySQL, ElasticSearch, and other backends. Any authenticated user with the Standard role can call the endpoint and read the response.

Root Cause

The root cause is missing authorization combined with absent output redaction. The route was implemented under the assumption that datasource listing was safe for non-administrators, while the serialization layer trusted callers to have full visibility. Neither the router nor the model performed a role check before serializing secrets.

Attack Vector

An attacker authenticates to Nightingale with any Standard role account, then issues a single POST request to /api/n9e/datasource/list. The response body contains complete datasource records including plaintext credentials. The attacker uses those credentials to authenticate directly to the downstream systems, bypassing Nightingale entirely.

// Security patch in center/router/router_datasource.go
// Source: https://github.com/ccfos/nightingale/commit/762819fbaa2350b73bce45bfaf6f8cf74b4abef8
user := c.MustGet("user").(*models.User)

list, err := models.GetDatasourcesGetsBy(rt.Ctx, typ, category, name, "")
list = rt.DatasourceCache.DatasourceFilter(list, user)

if !user.IsAdmin() {
    for _, ds := range list {
        ds.RedactSecrets()
    }
}

Render(c, list, err)

The patch adds an IsAdmin() gate and calls a new RedactSecrets() method on each datasource for non-administrators. A companion change in models/datasource.go documents that ClearPlaintext() is intended only for post-encryption cleanup and introduces RedactSecrets() for user-facing responses.

Detection Methods for CVE-2026-58167

Indicators of Compromise

Unusual POST /api/n9e/datasource/list requests originating from non-administrator session tokens
Response payloads from the datasource list endpoint containing non-empty settings, http.headers, or auth fields for Standard role users
Downstream datasource authentication events using Nightingale-stored credentials from client IPs that do not match the Nightingale server

Detection Strategies

Enable request logging on the Nightingale reverse proxy and alert on calls to /api/n9e/datasource/list by accounts whose role is not Admin
Correlate response size on the datasource list endpoint - inflated responses may indicate un-redacted secrets
Baseline expected callers of datasource management APIs and flag deviations from that allowlist

Monitoring Recommendations

Rotate and monitor credentials for all backends configured as Nightingale datasources, watching for authentication from unexpected sources
Review Nightingale audit logs for account creation and role assignment activity that could produce a Standard-role attacker foothold
Instrument SIEM alerts for downstream database or API authentication anomalies that align with post-disclosure credential abuse

How to Mitigate CVE-2026-58167

Immediate Actions Required

Upgrade Nightingale to 9.0.0-beta.2 or later, which applies the patch from pull request #3175
Rotate every credential stored in any Nightingale datasource, including database passwords, HTTP bearer tokens, basic-auth secrets, and mTLS client keys
Audit Nightingale user accounts and remove Standard role users that no longer need access
Restrict network access to the Nightingale API to trusted operator networks until upgrade is complete

Patch Information

The fix is delivered in the Nightingale v9.0.0-beta.2 release via commit 762819f. The patch adds an administrator check in the datasource list handler and introduces a RedactSecrets() method that scrubs sensitive fields before serialization to non-admin users. Additional context is available in the VulnCheck advisory and issue #3173.

Workarounds

Place Nightingale behind a reverse proxy that blocks POST /api/n9e/datasource/list for non-administrator session cookies
Temporarily downgrade all Standard role accounts or disable self-service account creation until the patched release is deployed
Move stored datasource credentials to short-lived tokens or vault-issued dynamic secrets to reduce impact if disclosure recurs

bash

# Example nginx snippet to block the vulnerable route pending upgrade
location = /api/n9e/datasource/list {
    if ($http_x_user_role != "Admin") {
        return 403;
    }
    proxy_pass http://nightingale_backend;
}