Is CVE-2026-44363 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44363 being exploited in the wild.

How severe is CVE-2026-44363?

Medium severity, with a CVSS score of 4, published 13 May 2026.

Which products and versions are affected?

MISP Project Misp-Modules < 3.0.7, <= 3.0.7; misp-modules (PyPI) ECOSYSTEM:introduced=0,last_affected=3.0.7.

Is there a fix for CVE-2026-44363?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44363 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-44363?

Check whether you run MISP Project Misp-Modules or misp-modules (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44363: MISP misp-modules SSRF and improper TLS validation in expansion modules

Q: Is there a fix for CVE-2026-44363?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-44363 attacked?

It is attacked from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-44363?

Check whether you run MISP Project Misp-Modules or misp-modules (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44363 · Severity: medium · CVSS 4 · Published 2026-05-13

MISP Modules, a set of expansion tools for the MISP threat intelligence platform, contains vulnerabilities in how it fetches remote data. These flaws could allow an attacker to probe internal network resources or intercept sensitive data during image retrieval. This could lead to the exposure of internal infrastructure details or the tampering of information being processed by the platform.

Technologies: MISP Project Misp-Modules. Vendors: MISP Project, PyPI.

Quick answers

Is CVE-2026-44363 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44363 being exploited in the wild.
How severe is CVE-2026-44363?: Medium severity, with a CVSS score of 4, published 13 May 2026.
Which products and versions are affected?: MISP Project Misp-Modules < 3.0.7, <= 3.0.7; misp-modules (PyPI) ECOSYSTEM:introduced=0,last_affected=3.0.7.
Is there a fix for CVE-2026-44363?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44363 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-44363?: Check whether you run MISP Project Misp-Modules or misp-modules (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Two distinct vulnerabilities exist in MISP Modules expansion modules. The 'html_to_markdown' module is vulnerable to Server-Side Request Forgery (SSRF) because it accepts arbitrary HTTP(S) URLs without validating against loopback, private, or link-local address ranges. Separately, the 'qrcode' module fails to verify TLS certificates when fetching remote images (CWE-295), enabling man-in-the-middle (MitM) attacks. An attacker can exploit these to access internal services or intercept/tamper with remote resources. The issues were addressed in the 01a522f commit by implementing URL scheme validation, IP blacklisting, and re-enabling TLS verification.

Affected products

MISP Project misp-modules <= 3.0.7

Identifiers

CVE-2026-44363
GHSA-fhq3-2gf3-8f3j
PYSEC-2026-2650

Timeline

2026-04-29: disclosed: Initial disclosure to MISP/misp-modules
2026-05-06: advisory: GitHub Advisory published
2026-05-13: advisory: NVD published CVE-2026-44363

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.