MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response (CVE-2026-127046)

What is affected, what to do

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer.

The available sources name no fixed version. Check the vendor guidance in the references below.

Affected

• Misp-modules lte *..3.1.4

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM. The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services. The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic. Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.

Source: cvelistv5, ENISA EUVD, CVE.org (MITRE), NVD (NIST)

Vendors and products

• MISP Misp-modules

Weakness classes (CWE)

• CWE-200Exposure of Sensitive Information to an Unauthorized Actor

  Class

  The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

  Entry at MITRE CWE-200

• CWE-522Insufficiently Protected Credentials

  Class

  The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

  Entry at MITRE CWE-522

References & sources

• github.comSecurity patchPatch, euvd
• NVD (NIST)vuln/detail/CVE-2026-127046euvd

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 12.11.2026ReceivedCIRCL

   CVSS V4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

   CISA assessment (SSVC): exploitation: none known, automatable: yes

   Weakness type: CWE-200, CWE-522

   Description added or changed

   New references:

   • https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af
   Show 7 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Description	added	—	The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM. The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services. The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic. Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.
   CVSS	added	—	AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
   Weakness type (CWE)	added	—	CWE-200
   Weakness type (CWE)	added	—	CWE-522
   Affected versions (publisher)	added	—	New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/127xxx/CVE-2026-127046.json">CVE-2026-127046</a>
   Reference	added	—	https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af
   SSVC assessment	added	—	{"role":"Supplier","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-11-12T11:59:08Z"}

   Source identifier: 5a6e4751-2f3f-4070-9419-94fb35b644e8