--- id: "CVE-2026-127046" page: "https://infrastack.ai/live/CVE-2026-127046" kind: "vulnerability" aliases: ["CVE-2026-127046"] title: "MISP Modules: external tools endpoint leaks stored API keys without login" severity: "critical" cvss: 9.2 epss: null exploited: false status: "open" category: "package" products: [{"name": "misp-modules", "fixed": [], "affected": "<= 3.1.4 (before commit 61c27893); first affected version unknown", "ecosystem": "pypi"}] ecosystems: [] tags: ["misp", "misp-modules", "package", "self-hosted"] not_affected_if: ["no-external-tools-configured", "website-not-network-exposed"] published_at: "2026-11-12T12:18:23+00:00" first_seen_at: "2026-11-12T12:38:18+00:00" updated_at: "2026-11-12T12:40:54+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127046", "first_seen_at": "2026-11-12T12:38:18+00:00"}, {"source": "analyst", "url": "https://github.com/MISP/misp-modules/releases", "first_seen_at": "2026-11-12T12:40:54+00:00", "cites": ["https://github.com/MISP/misp-modules/releases"]}] exploit_sources: [] --- # MISP Modules: external tools endpoint leaks stored API keys without login Link for people: https://infrastack.ai/live/CVE-2026-127046 (this .md is for agents) The MISP Modules website returns the stored API keys of configured external tools in the JSON from /external_tools/list, and the edit form puts the key into the page. An unauthenticated network client can read those keys and use them to impersonate the MISP instance or access the external services. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - pypi:misp-modules affected <= 3.1.4 (before commit 61c27893); first affected version unknown fixed no fixed version listed ## How to check - Request /external_tools/list without credentials on the MISP Modules website; if the JSON contains an api_key field, you are exposed. - Run 'git log' on your checkout: exposed if it does not contain commit 61c27893066cee80d9711649765ebc2bccd0e4af. v3.1.4 and earlier do not contain it. - If the website was reachable by untrusted clients, rotate the API keys stored for external tools. ## Fix No released version yet: the fix is commit 61c27893 on main (2026-11-12), after v3.1.4 (2026-11-08). Run a build that includes it, or the next release after v3.1.4. Until then, keep the MISP Modules website off the network or behind an authenticating proxy, and rotate API keys of configured external tools if it was reachable. ## Timeline - 2026-11-12T12:38:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127046 - 2026-11-12T12:40:54+00:00 analyst https://github.com/MISP/misp-modules/releases — Commit 61c2789 (2026-11-12, main) removes api_key from the serializer and makes the edit field write-only. Latest release v3.1.4 (2026-11-08) predates it; no fixed release found. Companion commits 28c27e3 'authorize external tool management' and 2c10e9a (CSRF) landed the same day. Auth-less claim comes from NVD text, not tested. Left unverified. ## Documents - [fix] Patch: github.com https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af - [mentions] MISP Modules releases (latest v3.1.4, 2026-11-08) https://github.com/MISP/misp-modules/releases ## From the sources The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM. The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services. The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic. Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_