CVE-2026-73160
Received Received - Intake

SSRF in cti-transmute via Unresolved Hostnames

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain names were accepted without resolving them first. An attacker could therefore use a hostname whose DNS record pointed to an internal address and cause the cti-transmute server to issue requests into its internal network. The commit explicitly states that anonymous callers could make the server request the internal target and read the response. The fix resolves hostnames using socket.getaddrinfo(), checks that every resolved address is globally routable, and additionally places @login_required on both affected MISP fetch/search routes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73160
EUVD
EUVD-2026-55992

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cti-transmute cti-transmute *
misp cti-transmute *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SSRF (Server-Side Request Forgery) in cti-transmute affecting the /fetch_misp_event and /misp_search_events endpoints. The issue allowed attackers to make the server request internal network addresses by using hostnames that resolve to private or internal IPs. The original validation only checked IP literals but not domain names, enabling DNS rebinding attacks.

Detection Guidance

To detect this vulnerability, monitor network traffic for requests originating from cti-transmute to internal IP addresses. Check logs for unauthorized access attempts to /fetch_misp_event or /misp_search_events endpoints. Use tools like tcpdump or Wireshark to inspect outbound HTTP requests from the server hosting cti-transmute.

Impact Analysis

An attacker could exploit this to force the cti-transmute server to send requests to internal systems, potentially accessing sensitive data or internal services. This could lead to data breaches, unauthorized access to internal resources, or further network compromise if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protecting sensitive health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update cti-transmute to the patched version. Ensure the @login_required decorator is applied to /fetch_misp_event and /misp_search_events endpoints. Review server logs for suspicious activity and block unauthorized access to these routes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73160. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart