---
id: CVE-2026-56783
title: Parseable < 2.9.2 - Cleartext Credential Exposure in Notification Target API
summary: >-
  Parseable before 2.9.2 contains an information disclosure vulnerability in the
  notification-target API endpoints that returns webhook tokens and basic-auth
  credentials in cleartext due to commented-out secret-masking functionality.
  Any a…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-522
vendor: parseablehq
product: parseable
affected:
  - parseable < 2.9.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-30T13:56:04.885437Z'
exploitAvailable: true
published: '2026-06-29'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:24.827Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56783'
references:
  - url: 'https://github.com/parseablehq/parseable/releases/tag/v2.9.2'
    label: parseable 2.9.2 Release Notes
  - url: 'https://github.com/parseablehq/parseable/issues/1693'
    label: Researcher Disclosure
  - url: 'https://github.com/parseablehq/parseable/pull/1698'
    label: Pull Request
  - url: >-
      https://github.com/parseablehq/parseable/commit/f307c4989cc9f3ff4204fd383dec7a39924e6b2a
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/parseable-cleartext-credential-exposure-in-notification-target-api
tags:
  - cve.org
  - exploit-available
epss: 0.00347
epssPercentile: 0.28453
ingestedAt: '2026-11-08T14:51:22.334Z'
---

## Overview

Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleartext due to commented-out secret-masking functionality. Any authenticated user with the GetAlert action, including low-privilege reader roles, can recover credentials and internal endpoint URLs for all configured notification targets by querying GET /api/v1/targets or related endpoints.

## Affected

- `parseable < 2.9.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.