CVE-2026-125871
Deferred Deferred - Pending Action

Server-Side Request Forgery in MISP Modules Sourcecache

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: CIRCL

Description
The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125871
EUVD
EUVD-2026-121039

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
MISP misp-modules From 0 (inc) to 3.0.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the MISP Modules (misp-modules) sourcecache expansion module. When a user with permission creates or modifies 'link' or 'url' attributes, the module sends HTTP requests to the submitted URL without validating the target address. Attackers can exploit this to force the MISP server to request internal services, loopback addresses, private networks, or cloud metadata endpoints, potentially exposing sensitive data like cloud credentials or internal application information.

Detection Guidance

Check MISP server logs for unusual HTTP requests to internal or loopback addresses (e.g., 127.0.0.1, 169.254.169.254). Review attributes of type 'link' or 'url' for suspicious URLs pointing to private networks or non-HTTP schemes. Use network monitoring tools to detect outbound requests from the MISP server to unexpected destinations.

Impact Analysis

An attacker with access to create or edit attributes could exfiltrate data from internal services reachable by the MISP server. This includes sensitive information like cloud metadata, internal application data, or local files if non-HTTP schemes like file:// are used. The impact depends on what services the MISP server can access.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, violating confidentiality requirements under GDPR and HIPAA. If exploited, it may result in data breaches, triggering compliance obligations such as breach notifications and potential fines.

Mitigation Strategies

Update misp-modules to the patched version. Implement strict URL validation in the sourcecache module to block non-HTTP/HTTPS schemes and non-globally routable addresses. Restrict user permissions to prevent unauthorized creation or modification of 'link' or 'url' attributes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125871. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...