CVE-2026-127046

Name of the Vulnerable Software and Affected Versions MISP Modules (affected versions not specified)

Description The website component of MISP Modules contains an information disclosure flaw within the external tools management interface. The '/external tools/list' endpoint returns stored API keys via the api key field in its JSON response. This endpoint is accessible without authentication, allowing any network-reachable client to retrieve API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, enabling an attacker to impersonate the MISP instance or access those services directly. Additionally, the browser-based edit form pre-populates the API key input field, exposing the credential in the Document Object Model (DOM). The 'change config' endpoint further contributed to this exposure by requiring the API key to be sent from the client during every save operation, causing the key to be stored in the browser's reactive state object and in-memory tool list.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.