CVE-2026-56783

MediumCVSS 6.5

Published: 29/06/2026(UTC)Updated: 14/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

Parseable before version 2.9.2 exposes webhook tokens and basic-auth credentials in cleartext via notification-target API endpoints due to commented-out secret-masking functionality. Any authenticated user with the GetAlert action, including low-privilege reader roles, can recover credentials and internal endpoint URLs by querying GET /api/v1/targets or related endpoints.

Risk Assessment

The organization risks leakage of sensitive credentials and internal endpoint URLs, potentially allowing an attacker to compromise configured notification targets and launch further attacks on the infrastructure.

Recommendation

Immediately upgrade Parseable to version 2.9.2 or later, which restores the secret-masking functionality. Until then, restrict API access to trusted users and monitor logs for unauthorized queries to /api/v1/targets.

Other vulnerabilities in Parseable

CVE-2026-32641High
Parseable prior to 3.0.0 uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling.

Original NVD description (English source)

Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleartext due to commented-out secret-masking functionality. Any authenticated user with the GetAlert action, including low-privilege reader roles, can recover credentials and internal endpoint URLs for all configured notification targets by querying GET /api/v1/targets or related endpoints.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS