Information Disclosure in MISP Modules External Tools Management Interface

CVE-2026-127046

What is CVE-2026-127046?

The MISP Modules website component exhibits an information disclosure flaw in the external tools management interface. The /external_tools/list endpoint discloses stored API keys in its JSON response, accessible without authentication, allowing unauthorized clients to retrieve sensitive credentials. Furthermore, the browser-based edit form pre-fills the API key input field, exposing these keys in the DOM and potentially leading to unauthorized access to external services authenticated by the compromised API keys. The flaw also affects the edit workflow, where the API key is unnecessarily handled in client memory, increasing exposure through network traffic. This vulnerability mitigates the confidentiality of the stored API keys, necessitating immediate attention.

References