# CVE-2026-125871: MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment

Status: published. Published: 2026-11-10. Updated: 2026-11-10.

The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files.

## Remediation

- fix: The fix introduces a URL validation gate (is_safe_url) that is invoked before any archiving request is made. The function restricts the scheme to http or https, resolves the hostname via DNS, and verifies that every resolved IP address is globally routable (i.e., not loopback, private, link-local, or otherwise non-global). If any check fails, the module returns an error and the fetch is never performed, preventing the server from being directed to internal or non-HTTP targets. (source: CNA: CIRCL)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: CIRCL) — https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841

## Affected products and versions

- MISP / misp-modules: ≥ 0; < 3.0.13 (affected, semver). Source: CNA: CIRCL

## Severity and prioritization

- CVSS 4.0: 6.3 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N; source: CNA: CIRCL

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable yes; technical impact partial; source CNA: CIRCL

- Weaknesses: CWE-918, CWE-20

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841 (CNA: CIRCL; patch)

## Provenance

- CNA: CIRCL: https://www.cve.org/CVERecord?id=CVE-2026-125871; retrieved 2026-11-10; source updated 2026-11-10

Revision: 66c7a36bb2b6569408df751adc0b562563bf700b67bbfec3b5b42a4b857a06ac

Canonical: https://y2.dev/cve/CVE-2026-125871

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.