{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amispmisp_modules/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:misp:misp_modules:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-127046"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["misp-modules"],"_cs_severities":["high"],"_cs_tags":["information-disclosure","cve","misp"],"_cs_type":"advisory","_cs_vendors":["MISP"],"content_html":"\u003cp\u003eCVE-2026-127046 is an information disclosure vulnerability in the MISP Modules website sub-application. The /external_tools/list endpoint returns stored API keys in its JSON response, and the browser-based edit form pre-populates the API key input field with the stored credential value. Because the /external_tools/list endpoint is accessible without authentication, network-reachable clients can retrieve the API keys for configured external tools.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact is limited to the confidentiality of stored API keys; their disclosure allows an attacker to impersonate the MISP instance or directly access external analysis or enrichment services. No integrity or availability impact on the MISP Modules website itself is indicated.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eRotate all API keys configured within the MISP Modules external tools management interface and update to the version containing the fix associated with commit 61c27893066cee80d9711649765ebc2bccd0e4af.\u003c/p\u003e\n","date_modified":"2026-11-12T16:47:07Z","date_published":"2026-11-12T16:47:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-127046/","summary":"An unauthenticated information disclosure vulnerability in the MISP Modules website component allows remote attackers to retrieve plaintext API keys for external services via the /external_tools/list endpoint.","title":"MISP Modules: Information Disclosure in External Tools (CVE-2026-127046)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-127046/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:misp:misp_modules:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-127016"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["misp-modules"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["MISP"],"content_html":"\u003cp\u003eThe MISP Modules website component, specifically the external_tools Flask blueprint, contains an authorization bypass vulnerability (CVE-2026-127016). When an ADMIN_PASSWORD is configured in the environment, the external tools management endpoints (add, delete, change status, and change configuration) fail to enforce administrator authentication. This allows unauthenticated attackers with network access to manipulate tool configurations. This vulnerability is conditional on the presence of an ADMIN_PASSWORD; installations without one are intentionally designed to allow open management access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn unauthenticated attacker can add, delete, or modify external tools, potentially modifying configurations including API keys and ingestion URLs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eRefer to the official repository commit for the patch and ensure appropriate administrative access controls are applied.\u003c/p\u003e\n","date_modified":"2026-11-12T15:22:35Z","date_published":"2026-11-12T15:22:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-127016-misp/","summary":"The MISP Modules website component contains an authorization bypass vulnerability (CVE-2026-127016) that allows unauthenticated network attackers to manage external tools when an administrator password is configured.","title":"MISP Modules: Unauthenticated external tool management bypass (CVE-2026-127016)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-127016-misp/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:misp:misp_modules:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}