The open-source threat intelligence platform MISP has a critical flaw in one of its own components that lets an unauthenticated attacker take control of its external tool settings. The vulnerability, tracked as CVE-2026-127016 and rated 9.2 out of 10, was published in the National Vulnerability Database on 12 November 2026, and it affects MISP Modules versions up to and including 3.1.4.

MISP, short for Malware Information Sharing Platform, is used by computer emergency response teams, banks, governments and security teams around the world to share indicators of compromise and coordinate their defences. The flaw sits in the MISP Modules website component, which lets administrators connect outside tools that enrich threat data. According to the National Vulnerability Database, the external tool management endpoints did not enforce the optional administrator authentication policy, even when an administrator password had been set.

What an attacker could do

An attacker with network access to the MISP Modules website could add arbitrary external tools, delete existing ones, switch them on or off, and change their settings, including stored API keys and the addresses used to fetch data. No login was needed. The module configuration pages themselves correctly demanded an administrator session when a password was configured, but the external tool handlers skipped that check entirely, as Corgea's research on the November disclosure wave also describes.

That gap matters because external tools in MISP hold credentials for other services. An attacker who could rewrite an ingestion address or swap in a tool of their own choosing could redirect the threat data a team relies on, or harvest the API keys stored for legitimate integrations. The flaw is classed as missing authorisation, tracked as CWE-862.

A password setting decides the risk

The vulnerability only bites when an administrator password, known as ADMIN_PASSWORD, has been set in the application environment. Installations running without one intentionally allow open management access by design, so they are not affected in the same way. That detail makes the flaw easy to miss: the very step an administrator takes to lock the system down is what exposes the broken check.

A fix has been recorded in the project's code history, in commit 28c27e30f6d3a10e38fe9c54bb52f57ccf70d027, which is listed on the NVD record. Administrators should update MISP Modules to a version containing that fix and check whether any external tool settings changed without authorisation.

A second flaw in the same component

CVE-2026-127016 is not the only problem found in the same component on the same day. A related flaw, CVE-2026-127046, also rated 9.2, affects the external tools list endpoint, which returned stored API keys in its JSON responses, exposing credentials to anyone able to reach it. The two flaws together mean that an exposed MISP Modules website could both leak integration keys and let a stranger rewrite how tools behave.

There is no reported evidence so far that either flaw has been exploited in the wild. Even so, the combination of a high score, no login required and a target used by defence teams makes this one to patch quickly. Any organisation running MISP Modules should confirm its version, apply the fix, rotate API keys used by its external tools, and restrict network access to the Modules website to trusted administrators only.