# MISP Modules: external tool changes bypass the administrator login Canonical: https://www.oktsec.com/radar/misp-modules-cve-2026-127016 Publisher: Oktsec Language: en Published: 2026-11-14T16:00:33Z Updated: 2026-11-14T16:00:33Z Record reviewed: 2026-11-14T16:00:33Z Latest evidence check: 2026-11-14T16:00:33Z Disclosed: 2026-11-12 When ADMIN_PASSWORD is set, affected external tool handlers still accept anonymous management requests. The maintainer published a correction in commit 28c27e30; the first packaged release containing it is not yet verified. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: A maintainer correction is available for missing authorization on external tool management. No exploitation is established in the reviewed sources. - Evidence: No attacks reported - Verification: Vendor confirmed - Fix status: Additional action required - Exposure requirement: Application or configuration dependent - Vendor: MISP - Products: MISP Modules website - CVEs: CVE-2026-127016 ## Technical overview The correction adds an authorization check before the four management handlers run. It does not change the intentional open management behavior when ADMIN_PASSWORD is absent. Removing that password is not a mitigation. A published commit is not evidence that a packaged release includes it. Verify the code deployed, or obtain confirmation from the maintainer before treating an installed release as corrected. ## Recommended response Restrict access to the Modules website and apply the maintainer correction through your supported deployment process. Verify that anonymous users cannot change external tools. Relevant to: Administrators of MISP Modules website. ## CVE attribution - CVE-2026-127016: MISP — MISP Modules website. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127016.json) ## Affected systems and fixes ### MISP Modules website / external_tools Affected: CNA identifies releases through 3.1.4, with ADMIN_PASSWORD configured and website access available to an attacker. Fixed release / action: Maintainer commit 28c27e30f6d3a10e38fe9c54bb52f57ccf70d027. First corrected packaged release not verified; do not assume 3.1.4 includes this commit. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.13 Checked: 2026-11-14T16:03:56.845Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-14T21:07:37.491Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-127016](https://api.first.org/data/v1/epss?cve=CVE-2026-127016): 0.66% probability of observed exploitation in the next 30 days; percentile 52.21%; score date 2026-11-14. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-14T21:07:37.491Z. ### Official regional advisories - [Vulnerabilidad en productos MISP](https://www.cert.gov.py/vulnerabilidad-en-productos-misp-6/) — CERT-PY, Paraguay; publication 2026-11-13T11:16:40.000Z; observed 2026-11-14T21:07:37.491Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Check the website configuration** — Identify whether the Modules website is deployed with ADMIN_PASSWORD and who can reach it. 2. **Apply and verify the authorization fix** — Use a build containing the reviewed maintainer correction. Confirm anonymous add, delete, status and configuration requests are rejected, including with valid CSRF tokens. 3. **Review external tool changes** — Oktsec recommends reviewing unexpected tools, status changes, API key configuration and ingestion destinations. Rotate credentials if evidence indicates exposure or misuse. ## Relevance to AI environments Verify the software and permissions behind automated operations. ## Sources - [Authorization correction and regression tests](https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027) — MISP; Vendor notice; checked 2026-11-14T16:00:33Z - [CVE scope and affected release range](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127016.json) — CIRCL (CNA record); Vendor notice; checked 2026-11-14T16:00:33Z - [Published releases: 3.1.4 remains latest at this review](https://github.com/MISP/misp-modules/releases) — MISP; Vendor notice; checked 2026-11-14T16:00:33Z ## Editorial record - 2026-11-14T16:00:33Z: Added affected scope, verified corrections and limits of the available evidence. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/misp-modules-cve-2026-127016) · [Build a response plan](https://www.oktsec.com/radar/misp-modules-cve-2026-127016#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=misp-modules-cve-2026-127016&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=misp-modules-cve-2026-127016&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.