External risk intelligence

MISP Modules API Key Information Disclosure

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-127046

The vulnerability exists in a web component and endpoint that is commonly deployed as an internet-facing service. Because the vulnerable endpoint is reachable without authentication and exposes sensitive API keys directly via web requests, it is likely to be exposed in real-world deployments where MISP modules are accessible over the network.

Information Disclosure

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a vulnerability in the MISP Modules website that could expose stored API keys. These keys are used to authenticate with external analysis or enrichment services, meaning their disclosure could allow an attacker to impersonate your MISP instance or access these third-party services. The main concern is confirming if this specific technology is in use and whether it is exposed to external access.

Sensitive API keys can be disclosed.
Potential for impersonation or unauthorized service access.
Confirm relevance and exposure of MISP Modules.

Attack Path

How an attacker could exploit the issue

An attacker can gain access to sensitive API keys by interacting with the external tools management interface of the MISP Modules website. The `/external_tools/list` endpoint, which is accessible to anyone on the network without needing to log in, unintentionally reveals these API keys in its JSON response. Additionally, the edit form within the browser exposes these keys directly in the web page's code. An attacker could then use these stolen API keys to impersonate the MISP instance or misuse external analysis services.

Accessible without authentication.
API keys exposed in JSON and DOM.
Disclosure of API keys.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could expose API keys used to authenticate with external analysis or enrichment services. When supported by the advisory, unauthenticated network access to the `/external_tools/list` endpoint could allow an attacker to retrieve these API keys. This could enable an attacker to impersonate the MISP instance or gain unauthorized access to these external services.

Stored API keys for external services.
Unauthenticated access to endpoint.
Impersonation of MISP instance.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MISP Modules website's external tools management interface presents an information disclosure risk due to the unauthenticated `/external_tools/list` endpoint exposing API keys. The first practical step is for the platform or infrastructure team to identify all instances of MISP Modules, confirm their network reachability and business criticality, and then locate the accountable owner for remediation. This process should involve coordinating with the MISP vendor if necessary to understand the available fixes or mitigations.

Platform/infrastructure teams own the issue.
Verify network reachability and criticality first.
Coordinate with MISP vendor for remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MISP Modules and how is it used?

MISP Modules is a sub-application that extends the functionality of the main MISP threat intelligence platform. It acts as an interface for managing external tools, such as enrichment services or analysis engines, that help security analysts process and investigate threat indicators. It functions as a connector, storing the necessary credentials to communicate with these third-party services securely.

What does CVE-2026-127046 mean for my API keys?

This vulnerability involves an information disclosure weakness (CWE-200 and CWE-522). Because the system incorrectly includes secret credentials in its responses and web forms, an unauthorized party can read the stored API keys. These keys are sensitive because they provide access to external services on your behalf, effectively acting as passwords for your integrations.

How does an attacker trigger this vulnerability?

An attacker does not need any special privileges or an account to trigger this bug. By simply sending a network request to the public `/external_tools/list` endpoint, they can force the server to return the API keys in plain text. Note that simply viewing the application or navigating the management interface is enough to expose the keys, even if no malicious commands are sent.

Is my MISP instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-priority concern because the vulnerable endpoint is often deployed in internet-facing configurations. If your MISP Modules interface is reachable over the public internet, it is likely accessible to anyone, significantly increasing the probability that an unauthorized user could retrieve your service credentials.

What should I do first to manage this CVE?

Begin by auditing your network configuration to determine if your MISP Modules interface is exposed to the internet or accessible to untrusted networks. Once you understand your current reachability, identify the team responsible for maintaining your MISP environment and coordinate with them to verify if you are running an affected version and to apply the necessary patches from the vendor.

References

github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765e…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.