Description
Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints.


The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain names were accepted without resolving them first. An attacker could therefore use a hostname whose DNS record pointed to an internal address and cause the cti-transmute server to issue requests into its internal network. The commit explicitly states that anonymous callers could make the server request the internal target and read the response.


The fix resolves hostnames using socket.getaddrinfo(), checks that every resolved address is globally routable, and additionally places @login_required on both affected MISP fetch/search routes.
Published: 2026-08-11
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated SSRF flaw exists in the /fetch_misp_event and /misp_search_events endpoints of cti‑transmute; the server accepts arbitrary hostnames that resolve to internal IP addresses and forwards requests to those addresses, exposing the internal network and allowing the attacker to read responses

Affected Systems

The vulnerability affects installations of the cti‑transmute component provided by MISP that have not yet applied the fix released in commit 4d29109a6f185d5e7c7f3b906f822ab34403f512

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity fault; EPSS is not available and the issue is not listed in KEV. Based on the description, it is inferred that the attack vector involves unauthenticated HTTP requests that trigger DNS resolution to internal IP addresses, enabling the server to reach internal resources if the service is reachable from the outside.

Generated by OpenCVE AI on August 11, 2026 at 10:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update cti‑transmute to the latest version that implements hostname resolution checks and requires authentication for the affected routes
  • Enable authentication on the /fetch_misp_event and /misp_search_events endpoints if not already enforced
  • Configure network controls or firewall rules to restrict outbound connections from the cti‑transmute service to internal IP ranges
  • Monitor logs for unexpected internal requests or DNS queries from the cti‑transmute application

Generated by OpenCVE AI on August 11, 2026 at 10:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Misp
Misp cti-transmute
Vendors & Products Misp
Misp cti-transmute

Tue, 11 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Description Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain names were accepted without resolving them first. An attacker could therefore use a hostname whose DNS record pointed to an internal address and cause the cti-transmute server to issue requests into its internal network. The commit explicitly states that anonymous callers could make the server request the internal target and read the response. The fix resolves hostnames using socket.getaddrinfo(), checks that every resolved address is globally routable, and additionally places @login_required on both affected MISP fetch/search routes.
Title cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-08-11T09:01:24.191Z

Reserved: 2026-08-11T09:01:22.135Z

Link: CVE-2026-73160

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T10:30:04Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)