Is CVE-2026-127016 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127016 being exploited in the wild.

How severe is CVE-2026-127016?

Informational severity, published 12 November 2026.

How is CVE-2026-127016 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-127016?

Check whether you run Misp-Modules. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127016: MISP Modules authorization bypass in external tools management

CVE-2026-127016 · Severity: info · Published 2026-11-12

MISP Modules is a website component that manages integrations with external security analysis tools. An unauthenticated attacker with network access could bypass administrator authentication to add malicious tools, delete existing ones, or modify configurations including API keys—but only if the administrator password feature is enabled. This could allow an attacker to inject backdoors or steal sensitive credentials into the MISP deployment.

Technologies: Misp-Modules. Vendors: Misp.

Quick answers

Is CVE-2026-127016 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127016 being exploited in the wild.
How severe is CVE-2026-127016?: Informational severity, published 12 November 2026.
Which products and versions are affected?: MISP MISP Modules.
Is there a fix for CVE-2026-127016?: Yes: fixed in Versions containing commit 28c27e30f6d3a10e38fe9c54bb52f57ccf70d027 or later. Until then: Ensure ADMIN_PASSWORD is configured in the application environment to enable authentication requirements on external tool management endpoints. Restrict network access to the MISP Modules website component to trusted administrators only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-127016 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-127016?: Check whether you run Misp-Modules. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Versions containing commit 28c27e30f6d3a10e38fe9c54bb52f57ccf70d027 or later

Ensure ADMIN_PASSWORD is configured in the application environment to enable authentication requirements on external tool management endpoints. Restrict network access to the MISP Modules website component to trusted administrators only.

Technical details

The external_tools Flask blueprint fails to enforce the optional ADMIN_PASSWORD authentication policy on management endpoints (add, delete, status change, configuration change), processing unauthenticated requests when authentication should be required. The vulnerability exists only when ADMIN_PASSWORD is configured; installations without an admin password intentionally permit open management by design. An attacker with network access can add arbitrary external tools with malicious configurations, delete tools, toggle active status, and modify API keys and ingestion URLs without authentication.

Affected products

MISP MISP Modules

Timeline

2026-11-12: disclosed
2026-11-12: patched: commit 28c27e30f6d3a10e38fe9c54bb52f57ccf70d027

References

https://github.com/MISP/misp-modules/commit/28c27e30f6d3a10e38fe9c54bb52f57ccf70d027

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.