CVE-2026-56783

Medium

Description

Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleartext due to commented-out secret-masking functionality. Any authenticated user with the GetAlert action, including low-privilege reader roles, can recover credentials and internal endpoint URLs for all configured notification targets by querying GET /api/v1/targets or related endpoints.

SeverityMedium

CVSS6.5

Exploit probability—

ProductParseable

PublishedJun 29, 2026

First seenJun 29, 2026

Weakness typeCWE-522CWE-522

How to fix

Update

parseablehq parseable2.9.2 or later

Patches

github.com/parseablehq/parseable/commit/f307c4989cc9f3ff4204fd383dec7a39924e6b2a

Vendor advisories

github.com/parseablehq/parseable/releases/tag/v2.9.2

Affected products

Product	Affected versions	Fixed in
parseablehq parseable	v < 2.9.2	2.9.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.