CVE-2026-44363

MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7, an unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. This vulnerability is fixed in 3.0.7.

• CWE-295
• CWE-918

• https://github.com/MISP/misp-modules/commit/01a522f2772fc31eeed379ccf23750c8a3d401db
• https://github.com/MISP/misp-modules/security/advisories/GHSA-fhq3-2gf3-8f3j

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44352Flowsint is an open-source OSINT graph exploration tool desi…5.3
• CVE-2026-44353Streamlink is a CLI utility which pipes video streams from v…6.5
• CVE-2026-44358Espressif Shared GitHub DangerJS is a reusable GitHub Action…8.2
• CVE-2026-44359Meshtastic is an open source mesh networking solution. Prior…10
• CVE-2026-4436A low-privileged remote attacker can send Modbus packets to …8.6
• CVE-2026-44362OP-TEE is a Trusted Execution Environment (TEE) designed as …5.5
• CVE-2026-44364MISP modules are autonomous modules that can be used to exte…9.3
• CVE-2026-44365Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-44366Vvveb is a powerful and easy to use CMS with page builder to…6.1
• CVE-2026-44367Klaw is a self-service Apache Kafka Topic Management/Governa…2.7
• CVE-2026-44368PyQuorum is a cryptographic library for secret sharing and k…6.9
• CVE-2026-44369CVAT is an open source interactive video and image annotatio…8.5