{"id":"CVE-2026-44363","kind":"vulnerability","aliases":["CVE-2026-44363","GHSA-fhq3-2gf3-8f3j"],"related":[],"title":"misp-modules has unsafe remote resource fetching in expansion","description":"MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7, an unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. This vulnerability is fixed in 3.0.7.","summary":"The html_to_markdown expansion module fetched arbitrary HTTP(S) URLs without enough validation, so a request could reach loopback, private, or link-local services (server-side request forgery). The qrcode module also turned off TLS certificate verification when fetching remote images, so those responses could be intercepted or altered.","severity":"medium","cvss":5.8,"epss":0.00102,"exploited":false,"exploited_at":null,"products":[{"name":"misp-modules","fixed":["3.0.8"],"affected":"< 3.0.8","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-295","cwe-918","misp","misp-modules","package","pypi","self-hosted"],"not_affected_if":["fixed-version","modules-disabled"],"how_to_check":"- Check the installed version with `pip show misp-modules` and compare it with the fixed version.\n- Confirm whether the html_to_markdown and qrcode expansion modules are enabled in your misp-modules deployment.","fix":"- misp-modules: upgrade to `3.0.8` or later (fixed in 3.0.8, affected below 3.0.8).","status":"open","published_at":"2026-05-06T22:31:03+00:00","first_seen_at":"2026-11-07T00:19:59+00:00","triaged_at":"2026-11-07T00:20:30+00:00","updated_at":"2026-11-07T00:44:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T00:20:30Z","model":"claude-haiku-5-5","output":{"fix":"- misp-modules: upgrade to `3.0.8` or later (fixed in 3.0.8, affected below 3.0.8).","reach":"network","title":"misp-modules: expansion modules fetch internal URLs and skip TLS checks","impact":"medium","summary":"The html_to_markdown expansion module fetched arbitrary HTTP(S) URLs without enough validation, so a request could reach loopback, private, or link-local services (server-side request forgery). The qrcode module also turned off TLS certificate verification when fetching remote images, so those responses could be intercepted or altered.","audience":"businesses","category":"package","nicknames":[],"who_cares":["misp","misp-modules","pypi","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Internal services reachable by the server, and remote images tampered with in transit","analyst_note":"","how_to_check":"- Check the installed version with `pip show misp-modules` and compare it with the fixed version.\n- Confirm whether the html_to_markdown and qrcode expansion modules are enabled in your misp-modules deployment.\n- unknown whether the sources give a configuration check beyond these.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","modules-disabled"],"who_is_affected":"Teams that run misp-modules as an expansion service for MISP are exposed, because the vulnerable modules fetch URLs that users or automation can supply. Systems that do not run misp-modules, or run a version at or above 3.0.8, are not affected by these flaws.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000977,"input_tokens":4447,"output_tokens":1065,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-295':26B '-44363':13A,21A '-918':28B '2gf3':17A '3.0.7':107C,208C '8f3j':18A 'accept':125C 'addit':150C 'address':187C 'allow':135C 'also':72B 'alter':89B 'arbitrari':45B,126C 'autonom':93C 'block':183C 'certif':76B,156C,201C 'could':55B,85B,134C 'cve':11A,19A 'cwe':25B,27B 'disabl':154C 'enabl':199C 'enforc':193C 'enough':50B 'exist':114C 'expans':10A,42B,118C 'expos':162C 'extend':100C 'fetch':8A,44B,79B,112C,192C 'fhq3':16A 'fix':178C,206C 'forgeri':68B,140C 'ghsa':15A 'ghsa-fhq3-2gf3-8f3j':14A 'host':37B 'hostnam':190C 'html':39B,121C 'http':46B,127C 'imag':81B,161C 'intercept':87B,171C 'issu':176C 'link':61B,146C 'link-loc':60B,145C 'local':62B,147C,184C 'loopback':57B,142C 'man':167C 'man-in-the-middl':166C 'markdown':41B,123C 'middl':170C 'misp':2A,23A,29B,31B,90C,101C,116C 'misp-modul':1A,30B 'misp-modules':22A 'modul':3A,32B,43B,71B,91C,94C,117C,119C,124C,153C 'modules':24A 'network':148C 'new':103C 'packag':33B 'potenti':165C 'prior':105C 'privat':58B,143C,186C 'pypi':34B 'qrcode':70B,152C 'rang':188C 're':198C 're-en':197C 'reach':56B 'remot':6A,80B,110C,160C 'request':54B,67B,139C,163C,194C 'resolv':189C 'resourc':7A,111C,149C 'respons':84B,173C 'retriev':159C 'scheme':182C 'self':36B 'self-host':35B 'server':65B,137C 'server-sid':64B,136C 'servic':63B,104C 'side':66B,138C 'suffici':131C 'tamper':174C 'timeout':195C 'tls':75B,155C,200C 'turn':73B 'unsaf':5A,109C 'url':48B,129C,181C 'use':98C 'valid':51B,132C,180C 'verif':77B,157C,202C 'vulner':113C,204C 'without':49B,130C","nicknames":[],"mitigations":[],"who_affected":"Teams that run misp-modules as an expansion service for MISP are exposed, because the vulnerable modules fetch URLs that users or automation can supply. Systems that do not run misp-modules, or run a version at or above 3.0.8, are not affected by these flaws.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mispmodules"],"ptokens":["misp","modules"],"labels":["cwe295","cwe918","medium","misp","mispmodules","package","pypi","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,20A '-44363':13A,21A '2gf3':17A '8f3j':18A 'cve':11A,19A 'expans':10A 'fetch':8A 'fhq3':16A 'ghsa':15A 'ghsa-fhq3-2gf3-8f3j':14A 'misp':2A,23A 'misp-modul':1A 'misp-modules':22A 'modul':3A 'modules':24A 'remot':6A 'resourc':7A 'unsaf':5A","search_b":"'-295':26B '-918':28B 'also':72B 'alter':89B 'arbitrari':45B 'certif':76B 'could':55B,85B 'cwe':25B,27B 'enough':50B 'expans':42B 'fetch':44B,79B 'forgeri':68B 'host':37B 'html':39B 'http':46B 'imag':81B 'intercept':87B 'link':61B 'link-loc':60B 'local':62B 'loopback':57B 'markdown':41B 'misp':29B,31B 'misp-modul':30B 'modul':32B,43B,71B 'packag':33B 'privat':58B 'pypi':34B 'qrcode':70B 'reach':56B 'remot':80B 'request':54B,67B 'respons':84B 'self':36B 'self-host':35B 'server':65B 'server-sid':64B 'servic':63B 'side':66B 'tls':75B 'turn':73B 'url':48B 'valid':51B 'verif':77B 'without':49B","search_c":"'3.0.7':107C,208C 'accept':125C 'addit':150C 'address':187C 'allow':135C 'arbitrari':126C 'autonom':93C 'block':183C 'certif':156C,201C 'could':134C 'disabl':154C 'enabl':199C 'enforc':193C 'exist':114C 'expans':118C 'expos':162C 'extend':100C 'fetch':112C,192C 'fix':178C,206C 'forgeri':140C 'hostnam':190C 'html':121C 'http':127C 'imag':161C 'intercept':171C 'issu':176C 'link':146C 'link-loc':145C 'local':147C,184C 'loopback':142C 'man':167C 'man-in-the-middl':166C 'markdown':123C 'middl':170C 'misp':90C,101C,116C 'modul':91C,94C,117C,119C,124C,153C 'network':148C 'new':103C 'potenti':165C 'prior':105C 'privat':143C,186C 'qrcode':152C 'rang':188C 're':198C 're-en':197C 'remot':110C,160C 'request':139C,163C,194C 'resolv':189C 'resourc':111C,149C 'respons':173C 'retriev':159C 'scheme':182C 'server':137C 'server-sid':136C 'servic':104C 'side':138C 'suffici':131C 'tamper':174C 'timeout':195C 'tls':155C,200C 'unsaf':109C 'url':129C,181C 'use':98C 'valid':132C,180C 'verif':157C,202C 'vulner':113C,204C 'without':130C","first_public_at":"2026-04-29T12:41:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-fhq3-2gf3-8f3j","url":"https://github.com/advisories/GHSA-fhq3-2gf3-8f3j","severity":"medium","published_at":"2026-05-06T22:31:03+00:00","modified_at":"2026-11-07T00:15:48+00:00","first_seen_at":"2026-11-07T00:19:59+00:00","fetched_at":"2026-11-07T00:25:02+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-44363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44363","severity":null,"published_at":"2026-05-13T20:16:23+00:00","modified_at":"2026-10-26T14:10:00+00:00","first_seen_at":"2026-11-07T00:44:49+00:00","fetched_at":"2026-11-07T00:44:49+00:00","note":null}],"documents":[{"id":91430,"url":"https://api.github.com/repos/MISP/misp-modules/security-advisories/GHSA-fhq3-2gf3-8f3j","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":91431,"url":"https://github.com/MISP/misp-modules/security/advisories/GHSA-fhq3-2gf3-8f3j","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-04-29T12:41:09+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":91432,"url":"https://github.com/MISP/misp-modules/commit/52cda9caa003cafe87e14ae3721db5e16f6f111a","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":91509,"url":"https://github.com/MISP/misp-modules/commit/01a522f2772fc31eeed379ccf23750c8a3d401db","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00102,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44363"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}