Loading story…
A high-severity server-side request forgery flaw tracked as CVE-2026-73160 was disclosed in MISP's cti-transmute component, affecting the /fetch_misp_event and /misp_search_events endpoints. The issue stemmed from validation that blocked direct private or reserved IP literals but still accepted ordinary hostnames without resolving them first, allowing an unauthenticated attacker to supply a domain that resolved to an internal address and force the server to send requests into its internal network and return the responses. The vulnerability is rated CVSS 4.0 8.7 (High) and is mapped to CWE-918.
MISP addressed the flaw by updating URL validation to resolve hostnames with socket.getaddrinfo() and reject targets if any resolved address is not globally routable, covering private, loopback, link-local, and reserved destinations. The fix also added login protection to both affected routes, reducing exposure of functionality that queries external MISP instances. Project notes indicate some residual DNS rebinding or post-validation DNS swap risk may remain for limited probing, but response-body exposure is constrained because valid TLS certificates are required for the hostname and redirects are not followed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-73160 was published for an unauthenticated SSRF vulnerability in MISP's cti-transmute affecting versions up to and including 1.4.0. The issue allowed attackers to supply hostnames resolving to internal addresses via the /fetch_misp_event and /misp_search_events endpoints, and it was rated CVSS 4.0 8.7 High.
A code change in MISP's cti-transmute updated URL validation to resolve hostnames and reject any non-globally-routable resolved addresses, mitigating SSRF through DNS-resolved internal IPs. The same patch also added @login_required to the /fetch_misp_event and /misp_search_events routes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MISP-related products were flagged for a vulnerability affecting website routes used to query external MISP instances, and CERT-PY published an advisory warning organizations about the issue. The exposed functionality involved the `/fetch_misp_event` and `/misp_search_events` endpoints, which could be reached without authentication and interacted with remote MISP servers, creating risk around unauthorized use and server-side request handling. A corresponding code change in `MISP/cti-transmute` hardened those routes by adding **authentication requirements** and stricter validation of external MISP URLs. The patch now resolves hostnames to all associated IP addresses and rejects targets if any address is not globally routable, blocking access to private, loopback, link-local, or reserved destinations and reducing **SSRF** exposure through DNS names; project notes also state that while DNS rebinding or post-validation DNS changes may still allow limited probing, response bodies remain constrained by TLS hostname validation and disabled redirects.
Aug 11, 2026
The Canadian Centre for Cyber Security warned that **MISP CTI-Transmute** versions `<= 1.4.0` are affected by multiple vulnerabilities, including **CVE-2026-69082** and **CVE-2026-69079`. One flaw allows **cross-site request forgery (CSRF)** against the administrative user-deletion endpoint because `/account/delete/<id>` accepted HTTP `GET` requests for a state-changing action, letting an attacker trick a logged-in administrator into deleting a chosen user account. The issue could cause unauthorized state changes, denial of access for affected users, and potential disruption if administrator accounts are targeted. A second high-severity flaw allows **unauthenticated denial of service** through the `/activity_timeline` endpoint, where an unbounded `days` parameter could be abused to force excessive database, CPU, and memory consumption and degrade site availability. The advisory also referenced remediation for blocking file and network fetches during evaluation PDF rendering, alongside fixes that cap the timeline range and require `POST` plus CSRF protection for user deletion. Administrators were urged to review the linked fixes and apply updates as they become available.
Aug 4, 2026
MISP **CTI-Transmute** was found to contain a high-severity flaw in its evaluation report PDF-generation feature, tracked as **`CVE-2026-69078`**, that could let attackers trigger **server-side request forgery (SSRF)** and disclose local files. The issue stemmed from rendering user-controlled cyber threat intelligence content with **WeasyPrint** using its default URL-fetching behavior, allowing crafted `http`, `https`, or `file` references embedded in report content to be fetched during PDF creation. A successful attack could probe internal hosts, access services reachable from the CTI-Transmute server, retrieve readable local files, and potentially expose fetched content inside generated PDFs. The vulnerability affects versions up to and including **1.4.0** and carries a **CVSS 4.0 score of 8.8**. The fix hardens PDF rendering by introducing a custom URL fetcher that blocks filesystem and network access and permits only **`data:`** URIs during report generation. The patch also removes an external **Google Fonts** import and replaces it with a system font stack so the reporting workflow performs zero external fetches. The restricted fetcher is now explicitly applied to the WeasyPrint PDF rendering call, closing the path for malicious `file://` and remote resource references embedded in untrusted CTI content.
Aug 3, 2026