vciy-2026-0004 · ccfos/nightingale · CWE-306

Unauthenticated datasource proxy routes in Nightingale when AnonymousAccess.PromQuerier is disabled

Verification of route authentication wiring in Nightingale alongside CVE-2026-58167 identified datasource query proxy routes registered outside the AnonymousAccess.PromQuerier conditional block without rt.auth() and rt.user() middleware.

Receipt & provenance · vciy-2026-0004

Advisory ID

vciy-2026-0004canonical vciy advisory identifier

Upstream project

ccfos/nightingaleGo

Affected versions

nightingale <= v9.3.0verified on upstream default branch

Weakness class

CWE-306Missing Authentication for Critical Function

Related CVE records

CVE-2026-58167upstream fix commit inspected

Upstream tracking

GHSA-vhwq-q4p4-5wjf (private upstream triage)reported 2026-10-22 · Coordinated disclosure in progress

Credit

Jonathan Corners (@JCorners68), Voxell, Inc. (https://vciy.com)discovered and reported

Record CVE-2026-58167 as mitigated Open CVE-2026-58167 evidence page All vciy advisories

Root cause and sibling analysis.

In Nightingale's router configuration, datasource query proxy routes are placed inside a conditional block so that when AnonymousAccess.PromQuerier is false, every route requires rt.auth() and rt.user() middleware. Routes registered outside that block on the base route group inherit no authentication middleware.

Detailed route names, handler locations, and a remediation diff have been filed privately with the upstream maintainers under GHSA-vhwq-q4p4-5wjf via GitHub Private Vulnerability Reporting. Full technical details will be published on this page once an upstream release is available.

Remediation.

Upgrade to the patched Nightingale release once published under GHSA-vhwq-q4p4-5wjf. Until a patched version is deployed, restrict network access to the /api/n9e/ surface at the ingress proxy.