CVE-2026-127046 MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externaltools/list endpoint returned stored API keys the apikey field in its JSON response via the ExternalTools model serializer. Additionally, the browser-based...

CVE-2026-127046

The MISP Modules website component contains an information disclosure vulnerability in the external_tools module. The /external_tools/list endpoint lacks authentication, allowing any network-reachable client to retrieve stored API keys via the ExternalTools model serializer. Additionally, the bro...