CVE-2026-127016
Deferred Deferred - Pending Action

External Tools Management Authentication Bypass in MISP Modules

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: CIRCL

Description
The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy. When ADMIN_PASSWORD was configured in the application environment, the module configuration endpoints correctly required an authenticated administrator session, but the external tools management handlers processed requests from anonymous users without any authorization check. An unauthenticated attacker with network access to the website could add arbitrary external tools, delete existing tools, toggle their active status, and modify their configurations including API keys and ingestion URLs. This inconsistency allowed bypass of the intended access control for the external tools management functionality. The vulnerability is conditional on ADMIN_PASSWORD being set; installations without an admin password intentionally permit open management access by design. The affected component is the external_tools Flask blueprint within the MISP Modules website application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-127016
EUVD
EUVD-2026-124335

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp-modules From 0 (inc) to 3.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MISP Modules website component has an issue where external tool management endpoints (add, delete, change status, change configuration) did not enforce administrator authentication when ADMIN_PASSWORD was configured. This allowed unauthenticated attackers to manipulate external tools, including adding, deleting, or modifying configurations like API keys and URLs.

Detection Guidance

Check MISP Modules logs for unauthorized external tool modifications. Inspect network traffic for POST requests to /tools endpoints without admin authentication. Review .env files for ADMIN_PASSWORD configuration and verify if external tool management endpoints lack proper authorization checks.

Impact Analysis

An attacker could add malicious external tools, delete legitimate ones, or alter tool configurations to exfiltrate data or disrupt operations. This is only possible if ADMIN_PASSWORD is set; otherwise, open management access is intended by design.

Compliance Impact

The vulnerability allows unauthenticated attackers to modify external tool configurations, including API keys and ingestion URLs, which could lead to unauthorized data access or exfiltration. This may violate GDPR's data protection principles (Article 32) requiring appropriate security measures and HIPAA's safeguards for protected health information if such data is involved.

Mitigation Strategies

Update MISP Modules to the patched version. Ensure ADMIN_PASSWORD is set in .env if admin authentication is required. Monitor external tools configurations for unauthorized changes. Restrict network access to MISP Modules administration interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...