GCVE-1-2026-20273 (CVE-2026-125871)

Vulnerability from gna-1 – Published: 2026-11-10 12:48 – Updated: 2026-11-10 15:01
VLAI
Title
MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment
Summary
The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files.
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
Supplier · CNA (v2.0.3)
Decision recorded 2026-11-10 11:02 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
  • CWE-20 - Improper Input Validation
Assigner
CIRCL GNA GNA-1
GNA scorecard A 90/100 over 254 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
MISP misp-modules Affected: 0 , < 3.0.13 (semver)
    cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
elhoim Claude Opus 5 (1M context)
GCVE extensions
bcp-05-x-01
AI-assisted vulnerability information annotation
GCVE-BCP-05-X-01
Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification
Model Source Identifier
qwen3.8:27b ollama qwen3.8:27b
bcp-05-x-02
Patch-to-vulnerability generation provenance
GCVE-BCP-05-X-02
Generator
patch2vuln.py on 2026-11-10 11:02
Model
qwen3.8:27b
Input
https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch 736974194693…
Confidence
high
Commit Subject Patch SHA-256
7cb31e96a1f5 fix: [sourcecache] validate URLs before archiving to block 736974194693…
Fix summary

The fix introduces a URL validation gate (is_safe_url) that is invoked before any archiving request is made. The function restricts the scheme to http or https, resolves the hostname via DNS, and verifies that every resolved IP address is globally routable (i.e., not loopback, private, link-local, or otherwise non-global). If any check fails, the module returns an error and the fetch is never performed, preventing the server from being directed to internal or non-HTTP targets.

Patch summary

Adds imports for ipaddress and socket. Introduces a new is_safe_url(url) function that parses the URL, rejects non-http/https schemes, resolves the hostname with socket.getaddrinfo, and rejects the URL if any resolved address fails ipaddress.ip_address().is_global(). In the handler() function, a guard clause calls is_safe_url(tocache) before invoking __archiveLink and returns an error dict if the URL is not safe. Two new unit tests verify that http://127.0.0.1:6379/ and file:///etc/passwd are blocked and that the archive function is never called.

CVSS rationale

AV:N: The MISP API is network-accessible. AC:L: Crafting a URL attribute with an internal address is trivial. AT:N: No special adversary technique is required. PR:L: An authenticated MISP user with attribute-creation rights is needed. UI:N: No victim interaction beyond the attacker's own API call. VC/VI/VA:N: The MISP server's own confidentiality, integrity, and availability are not directly compromised. SC:H: The subsequent component (internal services, cloud metadata) suffers high confidentiality impact because its data is exfiltrated into the MISP event. SI:N: The module only performs GET-style fetches; no evidence of integrity impact on subsequent components. SA:N: No availability impact on subsequent components is indicated.

Weakness rationale
  • CWE-918 The module accepts a user-supplied URL and issues a server-side HTTP request to it without validating the target, allowing an attacker to direct requests to internal or non-HTTP resources. This is a textbook SSRF.
  • CWE-20 The root cause is the absence of any validation on the URL attribute value before it is used as a request target. The fix adds scheme, hostname, and IP-address validation, confirming the missing input validation was the defect.
Attack pattern rationale
  • CAPEC-12 The patch explicitly describes and remediates an SSRF: an attacker-supplied URL causes the MISP server to fetch internal resources (loopback, cloud metadata) and return the data. CAPEC-12 is the direct and most specific attack pattern for this scenario. No uncertainty is noted; the commit message and code changes align precisely with this pattern.
Assumptions to verify
  • The MISP server is assumed to be reachable over the network and that an authenticated user with attribute-creation permissions can submit link/url attributes; no specific MISP version or authentication model is stated in the patch.
  • CVSS PR:L assumes a low-privilege authenticated MISP user can create attributes; if MISP requires higher-level permissions, PR could be H.
  • CVSS SI:N assumes the archiving function only performs read (GET) requests; if it can issue state-changing methods, SI could be elevated.
  • SSVC technical_impact 'partial' is the least-assumptive choice; if cloud metadata endpoint access leads to full credential theft and infrastructure takeover, impact could be 'total'.
  • The CAPEC-12 mapping is high-confidence based on the explicit SSRF description in the commit message and the code changes; no uncertainty is expected.
  • No specific affected or fixed version numbers are provided in the patch metadata; version boundaries are marked as unspecified.
  • The is_global check in Python's ipaddress module covers loopback, private, link-local, and other non-global ranges, but DNS rebinding between the check and the actual fetch is not addressed by this patch and could remain a residual risk.
Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model Score Agreement Confidence Assumptions
qwen3.8:27b 6 11 high 7
bcp-05-x-03
Vulnerability handling and disclosure timeline
GCVE-BCP-05-X-03
  1. 2026-10-16 22:27 UTC Fix developed Corrective change authored (7cb31e96a1f59bec9afbc087b27b26d9986c6841): fix: [sourcecache] validate URLs before archiving to block
  2. 2026-11-10 11:01 UTC Fix available Patch retrieved from the supplied URL; retrieval time is used as the default availability time.
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "sourcecache"
          ],
          "product": "misp-modules",
          "programFiles": [
            "misp_modules/modules/expansion/sourcecache.py"
          ],
          "repo": "https://github.com/MISP/misp-modules",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "3.0.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:misp:misp_modules:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.13",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "elhoim"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type \u0027link\u0027 or \u0027url\u0027 submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 Exploiting SSRF"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-11-10T11:02:25Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The fix introduces a URL validation gate (is_safe_url) that is invoked before any archiving request is made. The function restricts the scheme to http or https, resolves the hostname via DNS, and verifies that every resolved IP address is globally routable (i.e., not loopback, private, link-local, or otherwise non-global). If any check fails, the module returns an error and the fetch is never performed, preventing the server from being directed to internal or non-HTTP targets."
        }
      ],
      "title": "MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The MISP server is assumed to be reachable over the network and that an authenticated user with attribute-creation permissions can submit link/url attributes; no specific MISP version or authentication model is stated in the patch.",
                  "CVSS PR:L assumes a low-privilege authenticated MISP user can create attributes; if MISP requires higher-level permissions, PR could be H.",
                  "CVSS SI:N assumes the archiving function only performs read (GET) requests; if it can issue state-changing methods, SI could be elevated.",
                  "SSVC technical_impact \u0027partial\u0027 is the least-assumptive choice; if cloud metadata endpoint access leads to full credential theft and infrastructure takeover, impact could be \u0027total\u0027.",
                  "The CAPEC-12 mapping is high-confidence based on the explicit SSRF description in the commit message and the code changes; no uncertainty is expected.",
                  "No specific affected or fixed version numbers are provided in the patch metadata; version boundaries are marked as unspecified.",
                  "The is_global check in Python\u0027s ipaddress module covers loopback, private, link-local, and other non-global ranges, but DNS rebinding between the check and the actual fetch is not addressed by this patch and could remain a residual risk."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The patch explicitly describes and remediates an SSRF: an attacker-supplied URL causes the MISP server to fetch internal resources (loopback, cloud metadata) and return the data. CAPEC-12 is the direct and most specific attack pattern for this scenario. No uncertainty is noted; the commit message and code changes align precisely with this pattern."
                  }
                ],
                "commit": "7cb31e96a1f59bec9afbc087b27b26d9986c6841",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "elhoim"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The MISP API is network-accessible. AC:L: Crafting a URL attribute with an internal address is trivial. AT:N: No special adversary technique is required. PR:L: An authenticated MISP user with attribute-creation rights is needed. UI:N: No victim interaction beyond the attacker\u0027s own API call. VC/VI/VA:N: The MISP server\u0027s own confidentiality, integrity, and availability are not directly compromised. SC:H: The subsequent component (internal services, cloud metadata) suffers high confidentiality impact because its data is exfiltrated into the MISP event. SI:N: The module only performs GET-style fetches; no evidence of integrity impact on subsequent components. SA:N: No availability impact on subsequent components is indicated.",
                "draft": false,
                "fixSummary": "The fix introduces a URL validation gate (is_safe_url) that is invoked before any archiving request is made. The function restricts the scheme to http or https, resolves the hostname via DNS, and verifies that every resolved IP address is globally routable (i.e., not loopback, private, link-local, or otherwise non-global). If any check fails, the module returns an error and the fetch is never performed, preventing the server from being directed to internal or non-HTTP targets.",
                "generatedAt": "2026-11-10T11:02:25.004287Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "potentialErrors": [],
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 7,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "736974194693496cbcfe68e570862a9e221a43f5f6820180e20958b617ebb97c",
                "patchSummary": "Adds imports for ipaddress and socket. Introduces a new is_safe_url(url) function that parses the URL, rejects non-http/https schemes, resolves the hostname with socket.getaddrinfo, and rejects the URL if any resolved address fails ipaddress.ip_address().is_global(). In the handler() function, a guard clause calls is_safe_url(tocache) before invoking __archiveLink and returns an error dict if the URL is not safe. Two new unit tests verify that http://127.0.0.1:6379/ and file:///etc/passwd are blocked and that the archive function is never called.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "7cb31e96a1f59bec9afbc087b27b26d9986c6841",
                    "date": "Fri, 16 Oct 2026 22:27:37 +0000",
                    "patchSha256": "736974194693496cbcfe68e570862a9e221a43f5f6820180e20958b617ebb97c",
                    "retrievedAt": "2026-11-10T11:01:44.851219Z",
                    "source": "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch",
                    "sourceUrl": "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch",
                    "subject": "fix: [sourcecache] validate URLs before archiving to block"
                  }
                ],
                "source": "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-11-10T11:02:25Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sourcecache] validate URLs before archiving to block",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The module accepts a user-supplied URL and issues a server-side HTTP request to it without validating the target, allowing an attacker to direct requests to internal or non-HTTP resources. This is a textbook SSRF."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is the absence of any validation on the URL attribute value before it is used as a request target. The fix adds scheme, hostname, and IP-address validation, confirming the missing input validation was the defect."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (7cb31e96a1f59bec9afbc087b27b26d9986c6841): fix: [sourcecache] validate URLs before archiving to block",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch"
                    ],
                    "timestamp": "2026-10-16T22:27:37Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Patch retrieved from the supplied URL; retrieval time is used as the default availability time.",
                    "id": "evt-fix-available-1",
                    "references": [
                      "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch"
                    ],
                    "timestamp": "2026-11-10T11:01:44.851219Z",
                    "type": "fix-available"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20273"
        }
      ]
    }
  },
  "cveMetadata": {
    "cveId": "CVE-2026-125871",
    "datePublished": "2026-11-10T12:48:56.140741Z",
    "dateReserved": "2026-11-10T12:50:34.525Z",
    "dateUpdated": "2026-11-10T15:01:59.744395Z",
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-20273"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2.0"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.