CVE-2026-73160: cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses
Affected versions of cti-transmute contain an SSRF vulnerability in the /fetchmispevent and /mispsearchevents endpoints.
The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain names were accepted without resolving them first. An attacker could therefore use a hostname whose DNS record pointed to an internal address and cause the cti-transmute server to issue requests into its internal network. The commit explicitly states that anonymous callers could make the server request the internal target and read the response.
The fix resolves hostnames using socket.getaddrinfo(), checks that every resolved address is globally routable, and additionally places @loginrequired on both affected MISP fetch/search routes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add @login_required to the /fetch_misp_event route so anonymous callers cannot trigger SSRF requests.
cti-transmute /fetch_misp_event @login_required = enabled - Configuration
Add @login_required to the /misp_search_events route so anonymous callers cannot trigger SSRF requests.
cti-transmute /misp_search_events @login_required = enabled - Configuration
Update URL validation to resolve hostnames using socket.getaddrinfo(), then verify that every resolved address is globally routable (reject non-globally-routable targets).
cti-transmute hostname validation hostname resolution and address routability checks = use socket.getaddrinfo + require globally routable resolved addresses
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73160?
CVE-2026-73160 has a risk rating of 70.
How do I fix CVE-2026-73160?
To fix CVE-2026-73160, update cti-transmute to the latest version that addresses the SSRF vulnerability.
What types of attacks can exploit CVE-2026-73160?
CVE-2026-73160 can be exploited for server-side request forgery (SSRF) attacks, potentially accessing internal resources.
Which endpoints are affected by CVE-2026-73160?
The endpoints affected by CVE-2026-73160 are /fetch_misp_event and /misp_search_events.
What is the cause of the vulnerability in CVE-2026-73160?
The cause of CVE-2026-73160 is inadequate URL validation that allows domain names resolving to internal IP addresses.