Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11151 | Publication Date: 15 November 2026

Missing Authorization on External Tool Management in MISP Modules
CVE-2026-127016

Summary

A critical authorization bypass vulnerability has been identified in the MISP Modules website component. Tracked as CVE-2026-127016, the flaw allows an unauthenticated remote attacker to fully manage external tools when the optional administrator authentication is enabled.

The vulnerability has been assigned a CVSS v4.0 score of 9.2 (Critical). An attacker with network access to the MISP Modules website can add, delete, enable/disable, and reconfigure external tools, including the ability to modify API keys and ingestion URLs. The issue affects misp-modules versions up to and including 3.1.4.

Technical Overview

The MISP Modules website application provides management endpoints for external tools (add, delete, change status, and change configuration) through a Flask blueprint (external_tools). When the environment variable ADMIN_PASSWORD is configured, other sensitive endpoints (such as module configuration) correctly require an authenticated administrator session.

The external tools management handlers, however, did not enforce the same authorization check. Requests from anonymous users were processed without any authentication or authorization verification. This inconsistency allowed a complete bypass of the intended access control for external tool management.

Impact includes the ability to inject malicious external tools, remove legitimate ones, toggle their active state, and alter configuration data such as API keys and data ingestion endpoints. The vulnerability is conditional on ADMIN_PASSWORD being set; installations that intentionally leave management open (no admin password configured) are not considered vulnerable under this CVE, as open access is by design in that configuration.

Affected Systems

• misp-modules versions ≤ 3.1.4

Installations that have set ADMIN_PASSWORD and expose the MISP Modules website interface are at highest risk. Organizations running MISP for threat intelligence sharing and enrichment should verify their misp-modules version and exposure of the management interface.

Fixed version: Apply the upstream fix (commit available in the MISP/misp-modules repository) or upgrade to a release containing the authorization handler for the external_tools blueprint.

Exploitation Status

• Public disclosure on 12 November 2026.
• Public proof-of-concept / exploit references have been reported.
• A related critical issue in the same product (CVE-2026-127046, involving theft of stored API keys) was disclosed in the same timeframe.
• No widespread in-the-wild exploitation confirmed as of this advisory’s publication.
• Not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.

Recommendations

1. Immediate Action: Upgrade misp-modules to a fixed release that includes the authorization checks on the external_tools blueprint, or apply the upstream patch (commit 28c27e30f6d3a10e38fe9c54bb52f57ccf70d027 or successor).
2. After updating, restart the MISP Modules service / application so the patched code is loaded.
3. Confirm that the MISP Modules website management interface is not exposed to untrusted networks. Prefer binding it to internal/management networks only.
4. If ADMIN_PASSWORD is configured, verify that authentication is now enforced on all external tool management endpoints after the update.
5. Review existing external tools for unexpected entries, modified configurations, or unknown API keys and ingestion URLs. Rotate any API keys that may have been exposed or altered.
6. Review application and access logs for unauthenticated requests to external tool management endpoints around and after 12 November 2026.
7. If compromise is suspected, treat the instance as compromised: isolate it, preserve forensic evidence, rotate all related API keys and credentials, and perform a full integrity review of the MISP environment.

Although MISP Modules is a specialized component used primarily in threat intelligence environments, the combination of unauthenticated access, critical impact on tool configuration and API keys, and the sensitivity of data handled by MISP platforms justifies treating this as a high-priority update for any organization running the affected software.

Karen IT
We make the Internet harder to abuse.