CVE-2026-44363: SSRF in MISP Modules Expansion

The SSRF vulnerability in MISP Modules allows an attacker to craft malicious requests that originate from the MISP server itself. This bypasses typical network security controls, as the request appears to come from a trusted internal source. Specifically, the htmltomarkdown module's lack of URL validation permits requests to arbitrary HTTP(S) URLs, including those within loopback, private, or link-local network ranges. This could expose sensitive data residing on internal servers, such as configuration files, databases, or internal web applications. The qrcode module's disabled TLS certificate verification further exacerbates the risk, opening the door to man-in-the-middle attacks where an attacker can intercept and tamper with responses. Successful exploitation could lead to unauthorized access to internal systems and data, potentially compromising the entire MISP deployment and connected network segments.

1. Gereserveerd2026-05-05
2. Gepubliceerd2026-05-13
3. Gewijzigd2026-05-14

To mitigate CVE-2026-44363, upgrading to a patched version of MISP Modules is the primary recommendation. The fix involves rigorous URL scheme validation, blocking access to local and private address ranges, and resolving hostnames before fetching resources. If immediate upgrading is not feasible, consider implementing temporary workarounds. Restrict network access to the MISP server to only necessary resources. Implement a Web Application Firewall (WAF) or proxy with SSRF protection rules to filter out malicious requests. Carefully review and restrict the URLs that the htmltomarkdown module is allowed to access. After upgrading, confirm the fix by attempting to access a known internal resource via the htmltomarkdown module; the request should be blocked.