Server-Side Request Forgery Vulnerability in MISP Modules by MISP
CVE-2026-112991

6.3MEDIUM

Key Information:

Vendor

Misp

Status
Misp Modules
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112991?

The html_to_markdown expansion module in MISP Modules contains a vulnerability that allows authenticated users to conduct server-side request forgery (SSRF) attacks by submitting URLs that point to unblocked internal address ranges. This vulnerability arises from an incomplete BLOCKED_RANGES list, which fails to restrict several critical IP address ranges, including IPv6 unspecified addresses and link-local addresses. When exploited, the module can perform requests to internal services from the MISP server's context, enabling attackers to access sensitive information from otherwise unreachable services. Though the MISP instance remains intact, it is misused as a proxy to access restricted network resources, primarily compromising the confidentiality of the internal services.

Affected Version(s)

MISP Modules 0 <= 3.0.12

References

https://github.com/misp/misp-modules/commit/98a1c2c2f2976...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

elhoim
Claude Opus 5 (1M context)
.