CVE-2026-127046: MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response
The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externaltools/list endpoint returned stored API keys (the apikey field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM.
The /externaltools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services.
The vulnerability also affected the edit workflow: the changeconfig endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic.
Affected component: the website sub-application of MISP Modules, specifically the externaltools module (serializer in models.py, list endpoint, and the externaltoolsindex.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the api_key field from ExternalTools.to_json() so the /external_tools/list response does not return stored API keys.
MISP Modules website ExternalTools serializer api_key serialization = omitted - Configuration
Start the API key input empty; retain the previously stored key when the submitted value is blank or missing, and replace it only when a non-empty value is submitted.
MISP Modules website external-tools edit workflow API key input handling = write-only - Configuration
Reject API key values that are not strings or exceed the permitted length.
MISP Modules website external-tools edit workflow API key input validation = reject non-string or over-length values
Event History
Frequently Asked Questions
Who can retrieve the exposed API keys?
Any network-reachable client could retrieve API keys for all configured external tools because the /external_tools/list endpoint was accessible without authentication. Both authenticated and unauthenticated access were verified by regression tests.
What can an attacker do with a disclosed key?
The keys are used by the server to authenticate submissions to external analysis or enrichment services. An attacker may be able to impersonate the MISP instance or directly access the affected external services.
Is exposure limited to the API response?
No. The browser-based edit form also pre-populated the API key field with the stored credential, exposing it in the DOM. Browser JavaScript additionally kept the key in a reactive state object and the in-memory tool list during the edit workflow.
What change addresses the forced credential exposure during edits?
The prior change_config behavior required a non-empty API key on every save, forcing the credential to round-trip through the client. The referenced fix commit is 61c27893066cee80d9711649765ebc2bccd0e4af.