MISP Modules up to 3.1.4 external_tools module models.py api_key information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in MISP Modules up to 3.1.4. This issue affects some unknown processing of the file models.py of the component external_tools module. The manipulation of the argument api_key leads to information disclosure. This vulnerability is traded as CVE-2026-127046. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in MISP Modules up to 3.1.4. It has been rated as problematic. This issue affects some unknown functionality of the file models.py of the component external_tools module. The manipulation of the argument api_key with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM. The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services. The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic. Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-127046 since 11/12/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Applying the patch 61c27893066cee80d9711649765ebc2bccd0e4af is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• MISP

Name

• Modules

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion