{"api_version":"1","generated_at":"2026-11-10T17:31:29+00:00","cve":"CVE-2026-125871","urls":{"html":"https://cve.report/CVE-2026-125871","api":"https://cve.report/api/cve/CVE-2026-125871.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-125871","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-125871"},"summary":{"title":"MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment","description":"The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files.","state":"PUBLISHED","assigner":"CIRCL","published_at":"2026-11-10 13:18:23","updated_at":"2026-11-10 13:18:23"},"problem_types":["CWE-20","CWE-918","CWE-918 CWE-918 Server-Side Request Forgery (SSRF)","CWE-20 CWE-20 Improper Input Validation"],"metrics":[{"version":"4.0","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","score":"6.3","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"6.3","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841","name":"https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841","refsource":"5a6e4751-2f3f-4070-9419-94fb35b644e8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-125871","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125871","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"MISP","product":"misp-modules","version":"affected 3.0.13 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"The fix introduces a URL validation gate (is_safe_url) that is invoked before any archiving request is made. The function restricts the scheme to http or https, resolves the hostname via DNS, and verifies that every resolved IP address is globally routable (i.e., not loopback, private, link-local, or otherwise non-global). If any check fails, the module returns an error and the fetch is never performed, preventing the server from being directed to internal or non-HTTP targets.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"elhoim","lang":"en"},{"source":"CNA","value":"Claude Opus 5 (1M context)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*"],"modules":["sourcecache"],"product":"misp-modules","programFiles":["misp_modules/modules/expansion/sourcecache.py"],"repo":"https://github.com/MISP/misp-modules","vendor":"MISP","versions":[{"lessThan":"3.0.13","status":"affected","version":"0","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:misp:misp_modules:*:*:*:*:*:*:*:*","versionEndExcluding":"3.0.13","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"credits":[{"lang":"en","type":"remediation developer","value":"elhoim"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"}],"descriptions":[{"lang":"en","value":"The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files."}],"impacts":[{"capecId":"CAPEC-12","descriptions":[{"lang":"en","value":"CAPEC-12 Exploiting SSRF"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-11-10T11:02:25Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T12:57:57.142Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841"}],"solutions":[{"lang":"en","value":"The fix introduces a URL validation gate (is_safe_url) that is invoked before any archiving request is made. The function restricts the scheme to http or https, resolves the hostname via DNS, and verifies that every resolved IP address is globally routable (i.e., not loopback, private, link-local, or otherwise non-global). If any check fails, the module returns an error and the fetch is never performed, preventing the server from being directed to internal or non-HTTP targets."}],"title":"MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"none","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The MISP server is assumed to be reachable over the network and that an authenticated user with attribute-creation permissions can submit link/url attributes; no specific MISP version or authentication model is stated in the patch.","CVSS PR:L assumes a low-privilege authenticated MISP user can create attributes; if MISP requires higher-level permissions, PR could be H.","CVSS SI:N assumes the archiving function only performs read (GET) requests; if it can issue state-changing methods, SI could be elevated.","SSVC technical_impact 'partial' is the least-assumptive choice; if cloud metadata endpoint access leads to full credential theft and infrastructure takeover, impact could be 'total'.","The CAPEC-12 mapping is high-confidence based on the explicit SSRF description in the commit message and the code changes; no uncertainty is expected.","No specific affected or fixed version numbers are provided in the patch metadata; version boundaries are marked as unspecified.","The is_global check in Python's ipaddress module covers loopback, private, link-local, and other non-global ranges, but DNS rebinding between the check and the actual fetch is not addressed by this patch and could remain a residual risk."],"capecRationale":[{"capecId":"CAPEC-12","rationale":"The patch explicitly describes and remediates an SSRF: an attacker-supplied URL causes the MISP server to fetch internal resources (loopback, cloud metadata) and return the data. CAPEC-12 is the direct and most specific attack pattern for this scenario. No uncertainty is noted; the commit message and code changes align precisely with this pattern."}],"commit":"7cb31e96a1f59bec9afbc087b27b26d9986c6841","confidence":"high","credits":[{"lang":"en","type":"remediation developer","value":"elhoim"},{"lang":"en","type":"remediation developer","value":"Claude Opus 5 (1M context)"}],"cvssRationale":"AV:N: The MISP API is network-accessible. AC:L: Crafting a URL attribute with an internal address is trivial. AT:N: No special adversary technique is required. PR:L: An authenticated MISP user with attribute-creation rights is needed. UI:N: No victim interaction beyond the attacker's own API call. VC/VI/VA:N: The MISP server's own confidentiality, integrity, and availability are not directly compromised. SC:H: The subsequent component (internal services, cloud metadata) suffers high confidentiality impact because its data is exfiltrated into the MISP event. SI:N: The module only performs GET-style fetches; no evidence of integrity impact on subsequent components. SA:N: No availability impact on subsequent components is indicated.","draft":true,"fixSummary":"The fix introduces a URL validation gate (is_safe_url) that is invoked before any archiving request is made. The function restricts the scheme to http or https, resolves the hostname via DNS, and verifies that every resolved IP address is globally routable (i.e., not loopback, private, link-local, or otherwise non-global). If any check fails, the module returns an error and the fetch is never performed, preventing the server from being directed to internal or non-HTTP targets.","generatedAt":"2026-11-10T11:02:25.004287Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"potentialErrors":[],"rankings":[{"agreementScore":11,"assumptionCount":7,"confidence":"high","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"736974194693496cbcfe68e570862a9e221a43f5f6820180e20958b617ebb97c","patchSummary":"Adds imports for ipaddress and socket. Introduces a new is_safe_url(url) function that parses the URL, rejects non-http/https schemes, resolves the hostname with socket.getaddrinfo, and rejects the URL if any resolved address fails ipaddress.ip_address().is_global(). In the handler() function, a guard clause calls is_safe_url(tocache) before invoking __archiveLink and returns an error dict if the URL is not safe. Two new unit tests verify that http://127.0.0.1:6379/ and file:///etc/passwd are blocked and that the archive function is never called.","patchTruncated":false,"patches":[{"commit":"7cb31e96a1f59bec9afbc087b27b26d9986c6841","date":"Fri, 16 Oct 2026 22:27:37 +0000","patchSha256":"736974194693496cbcfe68e570862a9e221a43f5f6820180e20958b617ebb97c","retrievedAt":"2026-11-10T11:01:44.851219Z","source":"https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch","sourceUrl":"https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch","subject":"fix: [sourcecache] validate URLs before archiving to block"}],"source":"https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-11-10T11:02:25Z","version":"2.0.3"},"subject":"fix: [sourcecache] validate URLs before archiving to block","weaknessRationale":[{"cweId":"CWE-918","rationale":"The module accepts a user-supplied URL and issues a server-side HTTP request to it without validating the target, allowing an attacker to direct requests to internal or non-HTTP resources. This is a textbook SSRF."},{"cweId":"CWE-20","rationale":"The root cause is the absence of any validation on the URL attribute value before it is used as a request target. The fix adds scheme, hostname, and IP-address validation, confirming the missing input validation was the defect."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (7cb31e96a1f59bec9afbc087b27b26d9986c6841): fix: [sourcecache] validate URLs before archiving to block","id":"evt-fix-developed-1","references":["https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch"],"timestamp":"2026-10-16T22:27:37Z","type":"fix-developed"},{"description":"Patch retrieved from the supplied URL; retrieval time is used as the default availability time.","id":"evt-fix-available-1","references":["https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch"],"timestamp":"2026-11-10T11:01:44.851219Z","type":"fix-available"}]}}},"recordType":"advisory","vulnId":"gcve-1-2026-20273"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-125871","datePublished":"2026-11-10T12:57:57.142Z","dateReserved":"2026-11-10T12:50:34.525Z","dateUpdated":"2026-11-10T12:57:57.142Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 13:18:23","lastModifiedDate":"2026-11-10 13:18:23","problem_types":["CWE-20","CWE-918","CWE-918 CWE-918 Server-Side Request Forgery (SSRF)","CWE-20 CWE-20 Improper Input Validation"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-11-10T11:02:25Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"125871","Ordinal":"1","Title":"MISP sourcecache module SSRF allows fetching arbitrary internal ","CVE":"CVE-2026-125871","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"125871","Ordinal":"1","NoteData":"The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files.","Type":"Description","Title":"MISP sourcecache module SSRF allows fetching arbitrary internal "}]}}}