GO-2026-6638
Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale
Quick fix
GO-2026-6638 — github.com/ccfos/nightingale/v6: upgrade to the fixed version with the command below.
go get github.com/ccfos/nightingale/v6@v6.7.3-0.20260528033214-762819fbaa23Details
Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for github.com/ccfos/nightingale (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/ccfos/nightingale/v4 (go modules). Pin to a known-safe version or switch to an alternative.
0No fixed version published yet for github.com/ccfos/nightingale/v5 (go modules). Pin to a known-safe version or switch to an alternative.
0Fixed in: 6.7.3-0.20260528033214-762819fbaa23go get github.com/ccfos/nightingale/v6@v6.7.3-0.20260528033214-762819fbaa23References
- https://github.com/advisories/GHSA-27c6-wp53-387x[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2026-58167[ADVISORY]
- https://github.com/ccfos/nightingale/commit/762819fbaa2350b73bce45bfaf6f8cf74b4abef8[FIX]
- https://github.com/ccfos/nightingale/pull/3175[FIX]
- https://github.com/ccfos/nightingale/issues/3173[REPORT]
- https://github.com/ccfos/nightingale/releases/tag/v9.0.0-beta.2[WEB]
- https://www.vulncheck.com/advisories/nightingale-beta-2-datasource-credential-disclosure-to-low-privilege-users[WEB]