CVE-2026-66723 in CERT.PL
Summary
by MITRE • 07/29/2026
MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key. This can result in unauthorized actions being performed on the remote instance as if executed by the user whose API key was used to set up the remote instance. The vulnerability is limited to deployments where Remote Instances have been configured.This issue has been fixed in version 2.19.0
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability under discussion affects MWDB Core versions between 2.2.0 and 2.19.0, specifically targeting the Remote Instances proxy API component that handles external communications. This represents a critical authorization flaw that undermines the security model of the system by allowing unauthenticated access to sensitive administrative functions. The issue manifests when the proxy API fails to validate incoming requests, creating an attack vector where malicious actors can exploit the configured API key to execute unauthorized operations against remote MWDB instances. This vulnerability directly maps to CWE-285 which addresses insufficient authorization in software systems and aligns with ATT&CK technique T1078.3 for legitimate credentials use, as attackers can leverage existing API keys to impersonate authorized users.
The technical implementation flaw lies in the absence of proper authentication checks within the proxy API endpoint that manages communications between remote instances. When administrators configure remote instances, they typically establish API keys for secure communication, but this mechanism fails to validate incoming requests from external sources. An unauthenticated attacker can craft malicious requests and route them through the vulnerable proxy API, effectively using the configured API key to perform actions on the remote instance as if they were the legitimate user associated with that key. This creates a privilege escalation scenario where unauthorized parties gain access to the permissions and capabilities granted to the API key holder.
The operational impact of this vulnerability extends beyond simple unauthorized access, potentially enabling complete compromise of remote MWDB deployments. Attackers can leverage this flaw to modify, delete, or exfiltrate data from remote instances, perform administrative actions, and potentially establish persistent access through the compromised API key. The scope is limited to systems where Remote Instances have been configured, making it particularly concerning for organizations that rely on distributed MWDB deployments for threat intelligence sharing or collaborative analysis. This vulnerability essentially allows attackers to bypass authentication controls entirely, rendering the configured API keys ineffective as security boundaries.
Organizations affected by this vulnerability should immediately upgrade to MWDB Core version 2.19.0 or later, which contains the necessary fixes to properly validate authentication requests in the proxy API. System administrators should also review and rotate API keys for all remote instance configurations, particularly those used in production environments where sensitive threat intelligence data is stored. Additional mitigations include implementing network-level restrictions to limit access to the proxy API endpoints, monitoring for unusual patterns in remote instance communications, and conducting security reviews of all remote instance configurations to identify potential unauthorized access points. The fix addresses the core authorization issue by implementing proper authentication verification before processing any requests through the proxy API, ensuring that only authenticated entities can utilize the configured API keys for legitimate operations.