MISP Modules: Unauthenticated external tool management bypass (CVE-2026-127016)
The MISP Modules website component contains an authorization bypass vulnerability (CVE-2026-127016) that allows unauthenticated network attackers to manage external tools when an administrator password is configured.
CVE search metadata
CVE search record: CVE-2026-127016. KEV: no. Product: misp-modules. Brief: MISP Modules: Unauthenticated external tool management bypass (CVE-2026-127016). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-127016-misp/
Triage facts
Revision 1- Applicability
- misp-modules
- Evidence
- Confirmed activeHigh confidence
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 12, 15:22 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C2Likely
The MISP Modules website component, specifically the external_tools Flask blueprint, contains an authorization bypass vulnerability (CVE-2026-127016). When an ADMIN_PASSWORD is configured in the environment, the external tools management endpoints (add, delete, change status, and change configuration) fail to enforce administrator authentication. This allows unauthenticated attackers with network access to manipulate tool configurations. This vulnerability is conditional on the presence of an ADMIN_PASSWORD; installations without one are intentionally designed to allow open management access.
Impact
An unauthenticated attacker can add, delete, or modify external tools, potentially modifying configurations including API keys and ingestion URLs.
Recommendation
Refer to the official repository commit for the patch and ensure appropriate administrative access controls are applied.