CVE-2026-127046

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externaltools/list endpoint returned stored API keys the apikey field in its JSON response via the ExternalTools model serializer. Additionally, the browser-based...

CVE-2026-127046 MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externaltools/list endpoint returned stored API keys the apikey field in its JSON response via the ExternalTools model serializer. Additionally, the browser-based...

CVE-2026-127046

The MISP Modules website component contains an information disclosure vulnerability in the external_tools module. The /external_tools/list endpoint lacks authentication, allowing any network-reachable client to retrieve stored API keys via the ExternalTools model serializer. Additionally, the bro...

EUVD-2026-124365

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externaltools/list endpoint returned stored API keys the apikey field in its JSON response via the ExternalTools model serializer. Additionally, the browser-based...

CVE-2026-127016

The MISP Modules website component exposes external tool management endpoints add, delete, change status, and change configuration that did not enforce the optional administrator authentication policy. When ADMINPASSWORD was configured in the application environment, the module configuration...

CVE-2026-127016 MISP Modules Website: Missing Authorization on External Tool Management Endpoints

The MISP Modules website component exposes external tool management endpoints add, delete, change status, and change configuration that did not enforce the optional administrator authentication policy. When ADMINPASSWORD was configured in the application environment, the module configuration...

EUVD-2026-124335

The MISP Modules website component exposes external tool management endpoints add, delete, change status, and change configuration that did not enforce the optional administrator authentication policy. When ADMINPASSWORD was configured in the application environment, the module configuration...

CVE-2026-127016

The MISP Modules website application contains a missing authorization vulnerability in the external_tools Flask blueprint . When the ADMIN_PASSWORD environment variable is configured, the module configuration endpoints correctly require authentication, but the external tools management handlers f...

CVE-2026-127016: misp misp-modules: The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change…

The MISP Modules website component exposes external tool management endpoints add, delete, change status, and change configuration that did not enforce the optional administrator authentication policy. When ADMINPASSWORD was configured in the application environment, the module configuration...