# CVE-2026-127046: MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response

Status: published. Published: 2026-11-12. Updated: 2026-11-12.

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM.

The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services.

The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic.

Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.

## Remediation

- fix: The fix removes the api_key field from the ExternalTools.to_json() serializer so that /external_tools/list no longer returns credentials. The edit form is changed to a write-only pattern: the API key input starts empty, a blank or missing value on save retains the previously stored key, and a non-empty value replaces it. After a successful save the client clears the key field and does not propagate the credential into the in-memory tool list. Input validation is tightened to reject non-string or over-length key values. Server-side tool submissions continue to use the stored key from the database. (source: CNA: CIRCL)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: CIRCL) — https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af

## Affected products and versions

- misp / misp-modules: ≥ 0; ≤ 3.1.4 (affected, semver). Source: CNA: CIRCL

## Severity and prioritization

- CVSS 4.0: 9.2 (critical); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N; source: CNA: CIRCL

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable yes; technical impact partial; source CNA: CIRCL

- Weaknesses: CWE-200, CWE-522

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/MISP/misp-modules/commit/61c27893066cee80d9711649765ebc2bccd0e4af (CNA: CIRCL; patch)

## Provenance

- CNA: CIRCL: https://www.cve.org/CVERecord?id=CVE-2026-127046; retrieved 2026-11-12; source updated 2026-11-12

Revision: f77829698d3118a07f7e4396ae9f6e196982c82742fdddb40cc9b26898303b75

Canonical: https://y2.dev/cve/CVE-2026-127046

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.