Vulnerability · Published Aug 11, 2026 · Assigned by CIRCL
CVE-2026-73160cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses
High 8.7
In plain English
A high-severity server-side request forgery in cti-transmute from MISP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain names were accepted without resolving them first. An attacker could therefore use a hostname whose DNS record pointed to an internal address and cause the cti-transmute server to issue requests into its internal network. The commit explicitly states that anonymous callers could make the server request the internal target and read the response. The fix resolves hostnames using socket.getaddrinfo(), checks that every resolved address is globally routable, and additionally places @login_required on both affected MISP fetch/search routes.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MISP | cti-transmute | 0 – through 1.4.0 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N