CVE-2026-62143 Overview
CVE-2026-62143 is a Server-Side Request Forgery (SSRF) vulnerability in the html_to_markdown expansion module of misp-modules. The module enforces a blocklist against loopback, private, link-local, and other restricted IP ranges. However, it fails to normalize IPv4-mapped IPv6 addresses before comparison, allowing attackers to bypass the filter using notations such as http://[::ffff:127.0.0.1]/ or http://[::ffff:169.254.169.254]/. An authenticated attacker can force the module to reach internal services, administrative interfaces, or cloud instance metadata endpoints. The vulnerability is classified under CWE-918.
Critical Impact
Authenticated attackers can bypass SSRF filters to access loopback, internal, and link-local services, potentially exposing cloud metadata credentials and internal administrative interfaces.
Affected Products
- MISP misp-modules — html_to_markdown expansion module (versions prior to commit 3bae4108a3ba1e507727d5264697fd7303ba0b89)
- Deployments exposing the misp-modules service to authenticated users
- Cloud-hosted MISP instances with reachable instance metadata services
Discovery Timeline
- 2026-07-13 - CVE-2026-62143 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-62143
Vulnerability Analysis
The html_to_markdown module fetches remote HTML and converts it to Markdown for MISP users. To prevent SSRF, the module resolves the target hostname and compares the resulting IP address against blocked ranges including loopback (127.0.0.0/8), private (RFC 1918), and link-local (169.254.0.0/16) networks. The check operates on the address in its resolved form without canonicalizing IPv6 representations of IPv4 addresses. An IPv4-mapped IPv6 address such as ::ffff:127.0.0.1 embeds the IPv4 loopback address inside an IPv6 container. The blocklist logic treats this value strictly as an IPv6 address and finds no match against the IPv4 loopback range, allowing the request to proceed. Attackers can supply URLs using this notation directly, or point a controlled hostname to an IPv4-mapped IPv6 record so that DNS resolution yields the bypassing form.
Root Cause
The root cause is missing address normalization prior to range comparison. IPv4-mapped IPv6 addresses in the ::ffff:0:0/96 prefix are semantically equivalent to their embedded IPv4 counterparts, but the module compared them as if they were distinct address families. URLs without a valid hostname were also accepted without rejection.
Attack Vector
An authenticated user invokes the html_to_markdown expansion with a crafted URL. Supplying http://[::ffff:169.254.169.254]/latest/meta-data/ causes the module to connect to the AWS instance metadata service on the host running misp-modules. The retrieved response is converted to Markdown and returned to the attacker, exposing IAM credentials, user-data, and other sensitive metadata. Loopback targets such as http://[::ffff:127.0.0.1]:8080/ expose bound administrative interfaces. See the MISP Modules commit for the fix implementation.
Detection Methods for CVE-2026-62143
Indicators of Compromise
- Outbound HTTP requests from the misp-modules process to loopback, RFC 1918, or 169.254.169.254 destinations
- Module invocation logs containing URLs with ::ffff: prefixes in the host component
- DNS queries from the misp-modules host resolving external names to IPv4-mapped IPv6 records
- Unexpected access entries in cloud instance metadata service audit logs originating from the MISP host
Detection Strategies
- Inspect misp-modules request logs for URLs containing bracketed IPv6 hosts, particularly the ::ffff: prefix
- Correlate authenticated MISP module invocations with subsequent connections to internal address space
- Alert on any process bound to the misp-modules service initiating traffic to 169.254.169.254, 127.0.0.0/8, or private ranges when such traffic is not expected
Monitoring Recommendations
- Enable verbose logging on the misp-modules service and forward logs to a centralized analytics platform
- Monitor egress traffic from MISP infrastructure and baseline connections to metadata and internal endpoints
- Track authentication events tied to expansion module invocations to attribute suspicious activity to specific users
How to Mitigate CVE-2026-62143
Immediate Actions Required
- Update misp-modules to a release that includes commit 3bae4108a3ba1e507727d5264697fd7303ba0b89 or later
- Rotate any cloud credentials that may have been exposed through instance metadata access
- Audit misp-modules invocation logs for suspicious URLs referencing IPv4-mapped IPv6 addresses
- Restrict which authenticated users can invoke the html_to_markdown expansion module
Patch Information
The fix normalizes IPv4-mapped IPv6 addresses to their underlying IPv4 representation before applying blocked-range checks. URLs without a valid hostname are also rejected. Refer to the MISP Modules patch commit for implementation details.
Workarounds
- Disable the html_to_markdown expansion module until patching is complete
- Enforce Instance Metadata Service Version 2 (IMDSv2) on AWS hosts to require session tokens for metadata access
- Deploy an egress firewall or network policy that blocks outbound traffic from the misp-modules host to loopback, RFC 1918, and link-local ranges
- Configure the misp-modules container or host with a restricted network namespace that cannot reach internal management interfaces
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
