{"id":"CVE-2026-127016","kind":"vulnerability","aliases":["CVE-2026-127016"],"related":[],"title":"MISP Modules: anonymous users can change external tools when admin password set","description":"The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.","summary":"The MISP Modules website lets anonymous users add, delete, enable or disable, and reconfigure external tools even when ADMIN_PASSWORD is set, because the external tools handlers skip the admin check. An attacker with network access can change tool configurations, including API keys and ingestion URLs.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flask","misp","misp-modules","other","self-hosted","threat-intel"],"not_affected_if":["admin-password-unset","default-config","website-not-exposed"],"how_to_check":"- Check whether the MISP Modules website (website/ app, not the core misp-modules API) is deployed: look for a .env in website/ and a running misp-modules-website service or gunicorn main:app.\n- Check whether ADMIN_PASSWORD is set in that .env or environment. Only then does the missing check on the external tools handlers matter; with it unset, management is open by design.\n- Check whether the website port (default 7008) is reachable from untrusted networks.\n- Check that your install includes commit 28c27e3 (git log in your checkout). Affected version range is not stated by the sources: unknown.","fix":"No released version found yet. The fix is commit 28c27e3 on MISP/misp-modules main (website/app/external_tools/external_tools.py), after v3.1.4 (2026-11-08). Update to the first release that includes it, or run the website from a main build with that commit.","status":"open","published_at":"2026-11-12T10:17:28+00:00","first_seen_at":"2026-11-12T10:37:45+00:00","triaged_at":"2026-11-12T10:39:39+00:00","updated_at":"2026-11-12T10:41:03+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-12T10:39:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MISP Modules: anonymous users can change external tools when admin password set","impact":"high","summary":"The MISP Modules website lets anonymous users add, delete, enable or disable, and reconfigure external tools even when ADMIN_PASSWORD is set, because the external tools handlers skip the admin check. An attacker with network access can change tool configurations, including API keys and ingestion URLs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["misp","misp-modules","flask","threat-intel"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated users change external tool API keys and ingestion URLs","analyst_note":"Find the fixed MISP Modules version and the patch details at the linked GitHub patch; the sources do not name them.","how_to_check":"- Check whether the `ADMIN_PASSWORD` environment variable is set for the MISP Modules website.\n- Check whether the website is reachable from untrusted networks.\n- Check the MISP Modules version against the fixed version, which the sources do not name: unknown.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","website-not-exposed"],"who_is_affected":"Teams running the MISP Modules website component with `ADMIN_PASSWORD` set, where the website is reachable over the network. The flaw is in the external_tools Flask blueprint. Installations without an admin password are open by design and are not the flaw, and teams that do not expose the website can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000769,"input_tokens":4743,"output_tokens":590,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed MISP Modules version and the patch details at the linked GitHub patch; the sources do not name them.","search":"'-127016':15A,18A '-2026':14A,17A 'access':66B,142C,175C,201C 'activ':156C 'add':38B,87C,147C 'admin':10A,49B,60B,104C,188C,195C 'administr':100C,120C 'affect':205C 'allow':170C 'anonym':3A,36B,131C 'api':72B,163C 'applic':110C,218C 'arbitrari':148C 'attack':63B,139C 'authent':101C,119C 'author':135C 'blueprint':212C 'bypass':171C 'chang':6A,68B,89C,92C 'check':61B,136C 'compon':81C,206C 'condit':186C 'configur':70B,93C,107C,114C,161C 'control':176C 'correct':116C 'could':146C 'cve':13A,16A 'delet':39B,88C,151C 'design':203C 'disabl':42B 'enabl':40B 'endpoint':86C,115C 'enforc':97C 'environ':111C 'even':47B 'exist':152C 'expos':82C 'extern':7A,45B,55B,83C,124C,149C,179C,209C 'flask':19B,211C 'function':182C 'handler':57B,127C 'host':27B 'includ':71B,162C 'inconsist':169C 'ingest':75B,166C 'instal':192C 'intel':30B 'intend':174C 'intent':197C 'key':73B,164C 'let':35B 'manag':85C,126C,181C,200C 'misp':1A,20B,22B,32B,78C,215C 'misp-modul':21B 'modifi':159C 'modul':2A,23B,33B,79C,113C,216C 'network':65B,141C 'open':199C 'option':99C 'password':11A,50B,105C,189C,196C 'permit':198C 'polici':102C 'process':128C 'reconfigur':44B 'request':129C 'requir':117C 'self':26B 'self-host':25B 'session':121C 'set':12A,52B,191C 'skip':58B 'status':90C,157C 'threat':29B 'threat-intel':28B 'toggl':154C 'tool':8A,46B,56B,69B,84C,125C,150C,153C,180C,210C 'unauthent':138C 'url':76B,167C 'user':4A,37B,132C 'vulner':184C 'websit':34B,80C,145C,217C 'within':213C 'without':133C,193C","nicknames":[],"mitigations":[],"who_affected":"Teams running the MISP Modules website component with `ADMIN_PASSWORD` set, where the website is reachable over the network. The flaw is in the external_tools Flask blueprint. Installations without an admin password are open by design and are not the flaw, and teams that do not expose the website can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","flask","misp","mispmodules","other","selfhosted","threatintel"],"campaign_type":null,"search_a":"'-127016':15A,18A '-2026':14A,17A 'admin':10A 'anonym':3A 'chang':6A 'cve':13A,16A 'extern':7A 'misp':1A 'modul':2A 'password':11A 'set':12A 'tool':8A 'user':4A","search_b":"'access':66B 'add':38B 'admin':49B,60B 'anonym':36B 'api':72B 'attack':63B 'chang':68B 'check':61B 'configur':70B 'delet':39B 'disabl':42B 'enabl':40B 'even':47B 'extern':45B,55B 'flask':19B 'handler':57B 'host':27B 'includ':71B 'ingest':75B 'intel':30B 'key':73B 'let':35B 'misp':20B,22B,32B 'misp-modul':21B 'modul':23B,33B 'network':65B 'password':50B 'reconfigur':44B 'self':26B 'self-host':25B 'set':52B 'skip':58B 'threat':29B 'threat-intel':28B 'tool':46B,56B,69B 'url':76B 'user':37B 'websit':34B","search_c":"'access':142C,175C,201C 'activ':156C 'add':87C,147C 'admin':104C,188C,195C 'administr':100C,120C 'affect':205C 'allow':170C 'anonym':131C 'api':163C 'applic':110C,218C 'arbitrari':148C 'attack':139C 'authent':101C,119C 'author':135C 'blueprint':212C 'bypass':171C 'chang':89C,92C 'check':136C 'compon':81C,206C 'condit':186C 'configur':93C,107C,114C,161C 'control':176C 'correct':116C 'could':146C 'delet':88C,151C 'design':203C 'endpoint':86C,115C 'enforc':97C 'environ':111C 'exist':152C 'expos':82C 'extern':83C,124C,149C,179C,209C 'flask':211C 'function':182C 'handler':127C 'includ':162C 'inconsist':169C 'ingest':166C 'instal':192C 'intend':174C 'intent':197C 'key':164C 'manag':85C,126C,181C,200C 'misp':78C,215C 'modifi':159C 'modul':79C,113C,216C 'network':141C 'open':199C 'option':99C 'password':105C,189C,196C 'permit':198C 'polici':102C 'process':128C 'request':129C 'requir':117C 'session':121C 'set':191C 'status':90C,157C 'toggl':154C 'tool':84C,125C,150C,153C,180C,210C 'unauthent':138C 'url':167C 'user':132C 'vulner':184C 'websit':80C,145C,217C 'within':213C 'without':133C,193C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T10:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5a6e4751-2f3f-4070-9419-94fb35b644e8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127016","severity":null,"published_at":"2026-11-12T10:17:28+00:00","modified_at":"2026-11-12T10:17:29+00:00","first_seen_at":"2026-11-12T10:37:45+00:00","fetched_at":"2026-11-12T10:37:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127016:3725","url":null,"severity":null,"published_at":"2026-11-12T10:41:03+00:00","modified_at":"2026-11-12T10:41:03+00:00","first_seen_at":"2026-11-12T10:41:03+00:00","fetched_at":"2026-11-12T10:41:03+00:00","note":"Read fix commit 28c27e3 (adulau, 2026-11-12): adds admin-login check to external_tools add/delete/status/config handlers when ADMIN_PASSWORD set. Latest release seen is v3.1.4 (Nov 8), which predates the commit; no release containing the fix found. Affected range unknown."}],"documents":[{"id":133932,"url":"https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}