CVE-2026-73160

{
  "id": "CVE-2026-73160",
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
  "published": "2026-08-11T09:17:15.030",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints.\n\n\nThe URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain names were accepted without resolving them first. An attacker could therefore use a hostname whose DNS record pointed to an internal address and cause the cti-transmute server to issue requests into its internal network. The commit explicitly states that anonymous callers could make the server request the internal target and read the response.\n\n\nThe fix resolves hostnames using socket.getaddrinfo(), checks that every resolved address is globally routable, and additionally places @login_required on both affected MISP fetch/search routes."
    },
    {
      "lang": "es",
      "value": "Las versiones afectadas de cti-transmute contienen una vulnerabilidad SSRF en los endpoints /fetch_misp_event y /misp_search_events.\n\nLa rutina de validación de URL verificaba si un nombre de host proporcionado era en sí mismo un literal IP y rechazaba IPs privadas, de bucle invertido, de enlace local o reservadas. Sin embargo, los nombres de dominio ordinarios eran aceptados sin resolverlos primero. Un atacante podría, por lo tanto, usar un nombre de host cuyo registro DNS apuntaba a una dirección interna y hacer que el servidor cti-transmute emitiera solicitudes a su red interna. El commit establece explícitamente que los llamadores anónimos podrían hacer que el servidor solicitara el objetivo interno y leyera la respuesta.\n\nLa solución resuelve los nombres de host usando socket.getaddrinfo(), verifica que cada dirección resuelta sea globalmente enrutable y adicionalmente coloca @login_required en ambas rutas afectadas de recuperación/búsqueda de MISP."
    }
  ],
  "affected": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "affectedData": [
        {
          "vendor": "MISP",
          "product": "cti-transmute",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/MISP/cti-transmute",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.4.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T12:53:32.727939Z",
          "id": "CVE-2026-73160",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/MISP/cti-transmute/commit/4d29109a6f185d5e7c7f3b906f822ab34403f512",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ]
}