CVE-2026-58167: `/api/n9e/datasource/list` still discloses URL-embedded credentials

Question and Steps to reproduce

the original fix commit 762819fbaa2350b73bce45bfaf6f8cf74b4abef8 (fix: redact datasource secrets for non-admin users).

Issue

The fix for CVE-2026-58167 redacts settings, auth, HTTP headers, and mTLS key material from non-admin responses on POST /api/n9e/datasource/list, but it does not redact http.url or http.urls.

If a datasource stores reusable credentials in URL userinfo, for example http://user:password@host, a non-admin user who can view that datasource can still retrieve those credentials from the same list endpoint. This is the same exposure class as the original issue and is a repair omission in the redaction logic.

Code References

• Route remains user-accessible: center/router/router.go:612-614
• List handler returns redacted datasource objects to non-admin users: center/router/router_datasource.go:50-59
• Stored http and auth fields are reconstructed before redaction: models/datasource.go:449-487
• RedactSecrets() clears secret fields but preserves HTTPJson.Url and HTTPJson.Urls: models/datasource.go:569-588
• DatasourceCheck() requires only a non-empty http.url with an http/https prefix for the HTTP-backed plugin types it handles: center/router/router_datasource.go:390-398
• Error handling already treats http://user:pass@host as sensitive and masks it in error strings: center/router/router_datasource.go:174-179, center/router/router_datasource_test.go:5-40
• Grafana import also copies upstream datasource URL directly into HTTPJson.Url or HTTPJson.Urls: pkg/grafana/mapping.go:115-123

Reproduction

1. Log in as an administrator.
2. Create, update, or import a datasource whose http.url or http.urls contains URL userinfo credentials, for example:

http://admin:[email protected]:9090

1. Ensure the datasource is persisted. If the selected plugin type performs save-time connectivity checks, use a reachable endpoint or the no-test save path.
2. Log in as a non-admin user who can view that datasource.
3. Send:

POST /api/n9e/datasource/list
Authorization: Bearer <non-admin-session-token>
Content-Type: application/json

{}

1. The response includes the credential-bearing value in dat[].http.url or dat[].http.urls[]. Example:

{
  "dat": [
    {
      "id": 123,
      "name": "cred-in-url-demo",
      "http": {
        "url": "http://admin:[email protected]:9090"
      }
    }
  ],
  "err": ""
}

Impact

This allows a low-privilege authenticated user to recover reusable downstream credentials from the datasource list response. Those credentials can then be reused against the downstream monitoring or logging system referenced by the datasource.

Scope

This issue applies when credentials are stored in http.url or http.urls. Credentials stored only in auth, headers, or other fields already cleared by RedactSecrets() are not exposed by this residual path.

Relevant logs and configurations

None

Version

<=v9.1.1