CVE-2026-58167 is a missing authorization vulnerability in Nightingale (n9e) prior to version 9.0.0-beta.2. The API endpoint POST /api/n9e/datasource/list is accessible to authenticated users with a Standard role, but unlike other datasource mutation routes, it does not enforce admin-level authorization. Additionally, the open-source DatasourceFilter does not redact sensitive fields, resulting in the serialization and exposure of secret-bearing settings including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys. This exposure enables attackers with low privileges to obtain credentials that can be used to access downstream systems connected to the datasource.

The vulnerability allows any authenticated user with low privileges to retrieve sensitive credentials from datasource configurations. This includes plaintext passwords and tokens that can be used to access connected downstream systems, potentially leading to unauthorized data access or system compromise. The CVSS 3.1 base score is 6.5, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint to only trusted users or roles with administrative privileges. Review datasource configurations for exposed credentials and rotate any potentially compromised secrets. Monitor for updates from the vendor regarding official patches or mitigations.