CVE-2026-58167 is a missing authorization vulnerability in ccfos Nightingale (n9e) versions before 9.0.0-beta.2. The vulnerability arises from the POST /api/n9e/datasource/list API endpoint, which is accessible to authenticated users with a Standard role but does not enforce admin-level authorization. Unlike other datasource mutation routes, this endpoint returns full datasource configurations including sensitive secret fields such as plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys because the DatasourceFilter does not redact these secrets. This exposure allows low-privilege users to obtain credentials that can be used to access downstream systems connected to Nightingale.

The vulnerability allows any authenticated user with low privileges (Standard role) to retrieve sensitive credentials embedded in datasource configurations. These credentials include plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys. Disclosure of these secrets can lead to unauthorized access to downstream systems integrated with Nightingale, potentially compromising confidentiality of those systems. The vulnerability does not affect integrity or availability of Nightingale itself but poses a significant confidentiality risk to connected resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Nightingale API endpoints to trusted users only and monitor for unusual access patterns. Avoid using low-privilege accounts for sensitive operations. Review datasource configurations for exposed secrets and consider rotating credentials if exposure is suspected.