CVE-2026-44363 Details
Description
MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7, an unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. This vulnerability is fixed in 3.0.7.
A vulnerability allowing unsafe remote resource fetching has been identified in the MISP Modules expansion, prior to version 3.0.7. The issue arises in the 'html_to_markdown' module, which accepted arbitrary HTTP(S) URLs without adequate validation. This lack of validation could lead to Server-Side Request Forgery (SSRF) attacks against loopback, private, or link-local network resources. Additionally, the 'qrcode' module disabled TLS certificate verification when fetching remote images, making these requests susceptible to man-in-the-middle attacks or response tampering.
Users can update to MISP Modules version 3.0.7 or later, where this vulnerability has been fixed. Instructions for updating can be found in the MISP Modules repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 13, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MISP/misp-modules/commit/01a522f2772fc31eeed379ccf23750c8a3d401db | [email protected] | Source CodeVendor |
| https://github.com/MISP/misp-modules/security/advisories/GHSA-fhq3-2gf3-8f3j | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MISP Modules | < 3.0.7 (semver) |
CPE
Remediation
| |
| MISP Modules html_to_markdown | All versions |
CPE
Remediation
| |
| MISP Modules qrcode | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |