misp-modules: critical vulnerability

misp-modules

The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy.

Do this now

No source names a fix yet: limit who can reach misp-modules until one does.

Still cooking for misp-modules.

First seen: 12 Nov 2026
Last update: 12 Nov 2026, 19:18 UTC
Identifiers: CVE-2026-127016
CVSS: 9.2
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## misp-modules: critical vulnerability
Severity: critical. Patch status: fix status unknown.
Affected: misp-modules
Ids: CVE-2026-127016

The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that did not enforce the optional administrator authentication policy.

## Steps
1. Search the repo, its CI and infra config for misp-modules. If present, report the version in use and whether it's affected.
2. misp-modules <= 3.1.4: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| misp-modules <= 3.1.4 | not named in the CVE record | check the vendor advisory: https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-127016") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027 https://nvd.nist.gov/vuln/detail/CVE-2026-127016
https://pwned.coffee/i/the-misp-modules-website-component-exposes-external-tool-cve-2026-127016

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
misp-modules <= 3.1.4 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 12 Nov
The CVE record names no fix for one line; the vendor’s advisory may: github.com
Score: CVSS 9.2 (critical). CVSS 4.0 9.2 (CNA CIRCL) for CVE-2026-127016
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
misp-modules	<= 3.1.4	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 12 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee