CVE-2026-127016— MISP Modules Website: Missing Authorization on External Tool Management Endpoints

Quick assessment

Affected

misp misp-modules

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MISP Modules 网站组件暴露了外部工具管理接口（包括添加、删除、更改状态和修改配置），但这些接口未强制执行可选的管理员身份验证策略。当在应用环境中配置了 ADMIN_PASSWORD 时，模块配置接口会正确要求经过身份验证的管理员会话；然而，外部工具管理处理器却未进行任何授权检查，直接处理了来自匿名用户的请求。拥有网络访问权限的未认证攻击者因此可以添加任意外部工具、删除现有工具、切换其启用/禁用状态，并修改其配置（包括 API 密钥和摄取 URL）。这种不一致性导致外部工具管理功能本应实施的访问控制被绕过

CVSS 9.2 · Critical Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1068.004 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MISP Modules Website: Missing Authorization on External Tool Management Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
misp	misp-modules	0 ~ 3.1.4	`cpe:2.3:a:misp:misp-modules::::::::`

II. Public POCs for CVE-2026-127016

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-127016

请登录查看更多情报信息。

Other References for CVE-2026-127016 (1)

https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027 patch

https://www.cve.org/CVERecord?id=CVE-2026-127016

Same Patch Batch · misp · 2026-11-12 · 3 CVEs total

CVE-2026-127046	9.2 CRITICAL	MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response
CVE-2026-126991	5.3 MEDIUM	SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input

IV. Related Vulnerabilities

Same product: misp-modules

Same vendor: misp

Same weakness: CWE-862