{"api_version":"1","generated_at":"2026-11-12T12:53:30+00:00","cve":"CVE-2026-127046","urls":{"html":"https://cve.report/CVE-2026-127046","api":"https://cve.report/api/cve/CVE-2026-127046.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-127046","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-127046"},"summary":{"title":"MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response","description":"The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM.\n\nThe /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services.\n\nThe vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic.\n\nAffected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.","state":"PUBLISHED","assigner":"CIRCL","published_at":"2026-11-12 12:18:23","updated_at":"2026-11-12 12:18:23"},"problem_types":["CWE-200","CWE-522","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","CWE-522 CWE-522 Insufficiently Protected Credentials"],"metrics":[{"version":"4.0","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af","name":"https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af","refsource":"5a6e4751-2f3f-4070-9419-94fb35b644e8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-127046","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127046","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"misp","product":"misp-modules","version":"affected 3.1.4 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"The fix removes the api_key field from the ExternalTools.to_json() serializer so that /external_tools/list no longer returns credentials. The edit form is changed to a write-only pattern: the API key input starts empty, a blank or missing value on save retains the previously stored key, and a non-empty value replaces it. After a successful save the client clears the key field and does not propagate the credential into the in-memory tool list. Input validation is tightened to reject non-string or over-length key values. Server-side tool submissions continue to use the stored key from the database.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Alexandre Dulaunoy","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:misp:misp_modules:*:*:*:*:*:*:*:*"],"modules":["website/app/external_tools","website/app/models"],"product":"misp-modules","programFiles":["website/app/models/models.py","website/app/external_tools/external_tools.py","website/app/external_tools/external_tools_core.py","website/app/templates/external_tools/external_tools_index.html"],"repo":"https://github.com/MISP/misp-modules","vendor":"misp","versions":[{"lessThanOrEqual":"3.1.4","status":"affected","version":"0","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*","versionEndIncluding":"3.1.4","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"credits":[{"lang":"en","type":"remediation developer","value":"Alexandre Dulaunoy"}],"descriptions":[{"lang":"en","value":"The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM.\n\nThe /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services.\n\nThe vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic.\n\nAffected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch."}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Web Application Session Hijacking"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-11-12T11:59:08Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-522","description":"CWE-522 Insufficiently Protected Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T12:08:46.771Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af"}],"solutions":[{"lang":"en","value":"The fix removes the api_key field from the ExternalTools.to_json() serializer so that /external_tools/list no longer returns credentials. The edit form is changed to a write-only pattern: the API key input starts empty, a blank or missing value on save retains the previously stored key, and a non-empty value replaces it. After a successful save the client clears the key field and does not propagate the credential into the in-memory tool list. Input validation is tightened to reject non-string or over-length key values. Server-side tool submissions continue to use the stored key from the database."}],"title":"MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"none","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["The /external_tools/list endpoint is accessible without authentication based on regression tests that verify the response for both authenticated and unauthenticated clients; however, the README notes that management operations require ADMIN_PASSWORD, so the list endpoint's access control may vary by deployment configuration.","CVSS SC:H assumes the exposed API keys grant meaningful access to external services; the actual scope of access depends on the specific external tools configured and is not specified in the patch.","No specific product version or release boundary is identified in the patch; the affected version range is therefore marked as unspecified.","CAPEC-126 is the closest available pattern but is not a perfect match; the vulnerability is more precisely an API response information disclosure than a session hijacking. No CAPEC pattern specifically covers 'sensitive credential in API JSON response' without a session framing.","The commit references issue #816 but no reporter or finder is named in the patch metadata or commit message.","The 60-character maximum length validation for API keys is a new constraint introduced by the patch; it is unclear whether keys longer than 60 characters were previously valid, which could affect deployments with longer keys."],"capecRationale":[{"capecId":"CAPEC-126","rationale":"The closest available CAPEC pattern. The attack involves an attacker obtaining credential material (API keys) from a web application response and using it to authenticate to a subsequent service. CAPEC-126 covers the theft of session/credential tokens from a web application. The mapping is imperfect because the keys are long-lived API credentials rather than short-lived session tokens, and the attack does not involve a session per se, but the underlying mechanism (reading a credential from an HTTP response and replaying it) is the same class of attack. No CAPEC pattern specifically covers 'sensitive data in API response' without a session-hijacking framing, so this is the best available match."}],"commit":"61c27893066cee80d9711649765ebc2bccd0e4af","confidence":"medium","credits":[{"lang":"en","type":"remediation developer","value":"Alexandre Dulaunoy"}],"cvssRationale":"AV:N: the /external_tools/list endpoint is reachable over the network via HTTP. AC:L: exploitation requires only a single GET request with no special conditions. AT:N: no attack prerequisites such as race conditions or specific timing. PR:N: regression tests confirm the endpoint returns 200 and previously included api_key for both authenticated and unauthenticated clients, indicating no privilege is required. UI:N: no victim interaction is needed; the attacker simply reads the response. VC:H: the exposed data is API keys (credentials) for external services, representing high confidentiality loss. VI:N and VA:N: no integrity or availability impact on the MISP Modules website. SC:H: the stolen API keys can be used to authenticate to external analysis/enrichment services, representing high confidentiality impact on a subsequent component. SI:N and SA:N: no integrity or availability impact on subsequent components is indicated.","draft":false,"fixSummary":"The fix removes the api_key field from the ExternalTools.to_json() serializer so that /external_tools/list no longer returns credentials. The edit form is changed to a write-only pattern: the API key input starts empty, a blank or missing value on save retains the previously stored key, and a non-empty value replaces it. After a successful save the client clears the key field and does not propagate the credential into the in-memory tool list. Input validation is tightened to reject non-string or over-length key values. Server-side tool submissions continue to use the stored key from the database.","generatedAt":"2026-11-12T11:59:08.631868Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"potentialErrors":[],"rankings":[{"agreementScore":11,"assumptionCount":6,"confidence":"medium","model":"qwen3.8:27b","score":6}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"200a89910bce4823c08ee129545edc9fe7177cb0de9c5555925aa075155ca61b","patchSummary":"models.py: removed the api_key entry from ExternalTools.to_json(). external_tools.py (change_config endpoint): replaced the nested if-chain that required tool_api_key to be present and non-empty with a flat validation loop for tool_id/tool_name/tool_url, added a type-and-length check (string, max 60 chars) for tool_api_key when present, and made the field optional (write-only semantics). external_tools_core.py (change_config_core): changed tool.api_key assignment to be conditional on a truthy request_json.get('tool_api_key'). external_tools_index.html: initialized the form key field to empty string instead of tool.api_key, added placeholder and helper text, fixed a bug where the error-clearing selector referenced the wrong field, moved browser-state updates to after a successful HTTP response (res.ok check), and cleared the key input after save. README.md: documented the write-only key behavior. Tests: added browser-level (Playwright) and unit-level regression tests verifying the list endpoint omits api_key,空","patchTruncated":false,"patches":[{"commit":"61c27893066cee80d9711649765ebc2bccd0e4af","date":"Thu, 12 Nov 2026 09:37:45 +0100","patchSha256":"200a89910bce4823c08ee129545edc9fe7177cb0de9c5555925aa075155ca61b","retrievedAt":"2026-11-12T11:58:13.406720Z","source":"https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af.patch","sourceUrl":"https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af.patch","subject":"fix: [website] keep external tool API keys out of responses"}],"source":"https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-11-12T11:59:08Z","version":"2.0.3"},"subject":"fix: [website] keep external tool API keys out of responses","weaknessRationale":[{"cweId":"CWE-200","rationale":"The /external_tools/list endpoint returned stored API keys in its JSON response to any client (authenticated or not), exposing credentials to unauthorized parties. The browser form also pre-populated the key in the DOM."},{"cweId":"CWE-522","rationale":"API keys used to authenticate to external services were stored and transmitted without adequate protection: they appeared in API responses and in client-side form state, violating the principle that credentials should be write-only from the client perspective."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (61c27893066cee80d9711649765ebc2bccd0e4af): fix: [website] keep external tool API keys out of responses","id":"evt-fix-developed-1","references":["https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af.patch"],"timestamp":"2026-11-12T08:37:45Z","type":"fix-developed"},{"description":"Patch retrieved from the supplied URL; retrieval time is used as the default availability time.","id":"evt-fix-available-1","references":["https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af.patch"],"timestamp":"2026-11-12T11:58:13.406720Z","type":"fix-available"}]}}},"recordType":"advisory","vulnId":"gcve-1-2026-20141"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-127046","datePublished":"2026-11-12T12:05:04.052Z","dateReserved":"2026-11-12T12:04:58.364Z","dateUpdated":"2026-11-12T12:08:46.771Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 12:18:23","lastModifiedDate":"2026-11-12 12:18:23","problem_types":["CWE-200","CWE-522","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","CWE-522 CWE-522 Insufficiently Protected Credentials"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-11-12T11:59:08Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"127046","Ordinal":"1","Title":"MISP Modules Website Exposes External Tool API Keys in /external","CVE":"CVE-2026-127046","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"127046","Ordinal":"1","NoteData":"The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM.\n\nThe /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services.\n\nThe vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic.\n\nAffected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.","Type":"Description","Title":"MISP Modules Website Exposes External Tool API Keys in /external"}]}}}