{"id":"CVE-2026-56783","title":"Parseable < 2.9.2 - Cleartext Credential Exposure in Notification Target API","summary":"Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleartext due to commented-out secret-masking functionality. Any a…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-522"],"vendor":"parseablehq","product":"parseable","affected":["parseable < 2.9.2"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-30T13:56:04.885437Z"},"exploitAvailable":true,"published":"2026-06-29","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:06:24.827Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-56783","references":[{"url":"https://github.com/parseablehq/parseable/releases/tag/v2.9.2","label":"parseable 2.9.2 Release Notes"},{"url":"https://github.com/parseablehq/parseable/issues/1693","label":"Researcher Disclosure"},{"url":"https://github.com/parseablehq/parseable/pull/1698","label":"Pull Request"},{"url":"https://github.com/parseablehq/parseable/commit/f307c4989cc9f3ff4204fd383dec7a39924e6b2a","label":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/parseable-cleartext-credential-exposure-in-notification-target-api"}],"tags":["cve.org","exploit-available"],"epss":0.00347,"epssPercentile":0.28453,"ingestedAt":"2026-11-08T14:51:22.334Z","slug":"CVE-2026-56783","body":"## Overview\n\nParseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleartext due to commented-out secret-masking functionality. Any authenticated user with the GetAlert action, including low-privilege reader roles, can recover credentials and internal endpoint URLs for all configured notification targets by querying GET /api/v1/targets or related endpoints.\n\n## Affected\n\n- `parseable < 2.9.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}