Executive brief
Parseable, a log analytics platform, contained a flaw where sensitive credentials were exposed to unauthorized users. Low-privilege users could view cleartext passwords, webhook tokens, and secret internal URLs used for system notifications. This could allow an attacker with basic access to hijack notification channels or gain access to other internal corporate systems.
Technical details
An information disclosure vulnerability exists in Parseable's notification-target API endpoints (e.g., GET /api/v1/targets) due to commented-out secret-masking functionality in the backend handlers. While a masking helper existed in the code, it was not invoked, causing the API to serialize raw Target objects containing cleartext basic-auth passwords, webhook tokens, and sensitive Authorization headers. Any authenticated user with the 'GetAlert' action—which is included in the default low-privilege 'reader' role—can retrieve these secrets for all configured targets in a tenant. This allows for credential theft and potential lateral movement within the internal network. The issue is resolved in version 2.9.2 by re-enabling and hardening the masking logic.
Affected products
- Parseable Parseable < 2.9.2
Timeline
- 2026-06-23: patched: Fix merged in PR #1698 and released in v2.9.2
- 2026-06-29: disclosed: CVE published to NVD
References
- https://github.com/parseablehq/parseable/commit/f307c4989cc9f3ff4204fd383dec7a39924e6b2a
- https://github.com/parseablehq/parseable/issues/1693
- https://github.com/parseablehq/parseable/pull/1698
- https://github.com/parseablehq/parseable/releases/tag/v2.9.2
- https://www.vulncheck.com/advisories/parseable-cleartext-credential-exposure-in-notification-target-api