---
id: "CVE-2026-127016"
page: "https://infrastack.ai/live/CVE-2026-127016"
kind: "vulnerability"
aliases: ["CVE-2026-127016"]
title: "MISP Modules: anonymous users can change external tools when admin password set"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["flask", "misp", "misp-modules", "other", "self-hosted", "threat-intel"]
not_affected_if: ["admin-password-unset", "default-config", "website-not-exposed"]
published_at: "2026-11-12T10:17:28+00:00"
first_seen_at: "2026-11-12T10:37:45+00:00"
updated_at: "2026-11-12T10:41:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127016", "first_seen_at": "2026-11-12T10:37:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-12T10:41:03+00:00"}]
exploit_sources: []
---

# MISP Modules: anonymous users can change external tools when admin password set

Link for people: https://infrastack.ai/live/CVE-2026-127016 (this .md is for agents)

The MISP Modules website lets anonymous users add, delete, enable or disable, and reconfigure external tools even when ADMIN_PASSWORD is set, because the external tools handlers skip the admin check. An attacker with network access can change tool configurations, including API keys and ingestion URLs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the MISP Modules website (website/ app, not the core misp-modules API) is deployed: look for a .env in website/ and a running misp-modules-website service or gunicorn main:app.
- Check whether ADMIN_PASSWORD is set in that .env or environment. Only then does the missing check on the external tools handlers matter; with it unset, management is open by design.
- Check whether the website port (default 7008) is reachable from untrusted networks.
- Check that your install includes commit 28c27e3 (git log in your checkout). Affected version range is not stated by the sources: unknown.

## Fix

No released version found yet. The fix is commit 28c27e3 on MISP/misp-modules main (website/app/external_tools/external_tools.py), after v3.1.4 (2026-11-08). Update to the first release that includes it, or run the website from a main build with that commit.

## Timeline

- 2026-11-12T10:37:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127016
- 2026-11-12T10:41:03+00:00 analyst — Read fix commit 28c27e3 (adulau, 2026-11-12): adds admin-login check to external_tools add/delete/status/config handlers when ADMIN_PASSWORD set. Latest release seen is v3.1.4 (Nov 8), which predates the commit; no release containing the fix found. Affected range unknown.

## Documents

- [fix] Patch: github.com https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027

## From the sources

The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_