CVE-2026-127046

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM. The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services. The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic. Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.

• CWE-200
• CWE-522

• https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af

Published

Nov 12, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12702In affected versions of Octopus Deploy Insufficient checks o…4.9
• CVE-2026-127029A flaw was found in freeradius's Extensible Authentication P…7.5
• CVE-2026-12703TeamViewer Full Client and Host for macOS before version 15.…8
• CVE-2026-127030A flaw was found in freeradius. An improper length validatio…7.5
• CVE-2026-127036Improper neutralization of CRLF sequences ('CRLF injection')…8.6
• CVE-2026-12704When SAML IdP-initiated login is enabled in Grafana Enterpri…6.8
• CVE-2026-12705Missing support for integrity check vulnerability in ABB KNX…6.4
• CVE-2026-127050Backup Migration before 2.1.8 for WordPress contains a path …6.4
• CVE-2026-127056PapaParse before 5.7.1 contains an inefficient algorithmic c…7.5
• CVE-2026-127058WonderCMS before 3.7.0 contains an unverified password chang…4.9
• CVE-2026-12706A use-after-free vulnerability was found in FFmpeg's RASC vi…6.5
• CVE-2026-127063The third-party RMM+ extension for ConnectWise ScreenConnect…9.3