https://feed.craftedsignal.io/cpes/cpe2.3amispmisp_modules/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 16:47:07 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-127046/Thu, 12 Nov 2026 16:47:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-127046/An unauthenticated information disclosure vulnerability in the MISP Modules website component allows remote attackers to retrieve plaintext API keys for external services via the /external_tools/list endpoint.CVE-2026-127046 is an information disclosure vulnerability in the MISP Modules website sub-application. The /external_tools/list endpoint returns stored API keys in its JSON response, and the browser-based edit form pre-populates the API key input field with the stored credential value. Because the /external_tools/list endpoint is accessible without authentication, network-reachable clients can retrieve the API keys for configured external tools.

Impact

The impact is limited to the confidentiality of stored API keys; their disclosure allows an attacker to impersonate the MISP instance or directly access external analysis or enrichment services. No integrity or availability impact on the MISP Modules website itself is indicated.

Recommendation

Rotate all API keys configured within the MISP Modules external tools management interface and update to the version containing the fix associated with commit 61c27893066cee80d9711649765ebc2bccd0e4af.

]]>highadvisoryinformation-disclosurecvemisphttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-127016-misp/Thu, 12 Nov 2026 15:22:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-127016-misp/The MISP Modules website component contains an authorization bypass vulnerability (CVE-2026-127016) that allows unauthenticated network attackers to manage external tools when an administrator password is configured.The MISP Modules website component, specifically the external_tools Flask blueprint, contains an authorization bypass vulnerability (CVE-2026-127016). When an ADMIN_PASSWORD is configured in the environment, the external tools management endpoints (add, delete, change status, and change configuration) fail to enforce administrator authentication. This allows unauthenticated attackers with network access to manipulate tool configurations. This vulnerability is conditional on the presence of an ADMIN_PASSWORD; installations without one are intentionally designed to allow open management access.

Impact

An unauthenticated attacker can add, delete, or modify external tools, potentially modifying configurations including API keys and ingestion URLs.

Recommendation

Refer to the official repository commit for the patch and ensure appropriate administrative access controls are applied.

]]>highthreat