MISP Modules: Information Disclosure in External Tools (CVE-2026-127046)
An unauthenticated information disclosure vulnerability in the MISP Modules website component allows remote attackers to retrieve plaintext API keys for external services via the /external_tools/list endpoint.
CVE search metadata
CVE search record: CVE-2026-127046. KEV: no. Product: misp-modules. Brief: MISP Modules: Information Disclosure in External Tools (CVE-2026-127046). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-127046/
Triage facts
Revision 1- Applicability
- misp-modules
- Evidence
- Not observed
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 12, 16:47 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-127046 is an information disclosure vulnerability in the MISP Modules website sub-application. The /external_tools/list endpoint returns stored API keys in its JSON response, and the browser-based edit form pre-populates the API key input field with the stored credential value. Because the /external_tools/list endpoint is accessible without authentication, network-reachable clients can retrieve the API keys for configured external tools.
Impact
The impact is limited to the confidentiality of stored API keys; their disclosure allows an attacker to impersonate the MISP instance or directly access external analysis or enrichment services. No integrity or availability impact on the MISP Modules website itself is indicated.
Recommendation
Rotate all API keys configured within the MISP Modules external tools management interface and update to the version containing the fix associated with commit 61c27893066cee80d9711649765ebc2bccd0e4af.
Detection coverage 1
Detect CVE-2026-127046 Exploitation Attempt
mediumDetects unauthenticated GET requests to the /external_tools/list endpoint, which is the primary vector for extracting API keys.
Detection queries are available on the platform. Get full rules →