CVE-2026-63098: TheHive Information Disclosure Flaw

CVE-2026-63098 Overview

CVE-2026-63098 is an unauthenticated information disclosure vulnerability in TheHive through version 4.1.24. The flaw exists in the /api/status endpoint, which is handled by StatusCtrl.scala without any authentication enforcement. Unauthenticated attackers can issue a simple GET request to this endpoint and retrieve sensitive configuration data. The exposed data includes the datastore attachment protection password, configured authentication providers, single sign-on (SSO) settings, multi-factor authentication (MFA) capabilities, and clustered node addresses and roles. The vulnerability is categorized under Missing Authentication for Critical Function [CWE-306].

Critical Impact
Remote unauthenticated attackers can enumerate authentication mechanisms, cluster topology, and retrieve the attachment protection password from any internet-exposed TheHive instance.

Affected Products

TheHive through 4.1.24
TheHive StatusCtrl.scala API handler
TheHive clustered deployments exposing /api/status

Discovery Timeline

2026-07-17 - CVE-2026-63098 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-63098

Vulnerability Analysis

TheHive is an open-source Security Incident Response Platform (SIRP) used by security operations teams to manage cases and observables. The /api/status endpoint is intended to provide operational health information, but its handler StatusCtrl.scala omits authentication checks. Any network-reachable client can invoke the endpoint and receive a JSON response containing configuration details that should be restricted to authenticated administrators.

The disclosed content includes the datastore attachment protection password, which is used to protect malware and evidence attachments stored by the platform. Attackers who obtain this password can decrypt exported attachments retrieved from the datastore. The response also enumerates the configured authentication providers, SSO settings, and MFA capabilities, enabling attackers to plan credential attacks against the weakest configured provider.

Root Cause

The root cause is missing authentication enforcement on a critical function [CWE-306]. The StatusCtrl.scala handler serves configuration metadata without invoking the framework's authentication middleware. Sensitive fields that would normally require administrator privileges are returned in the same response as basic health indicators.

Attack Vector

Exploitation requires only network access to the TheHive web interface. The attacker sends an unauthenticated HTTP GET request to /api/status and parses the JSON response. No user interaction, credentials, or elevated privileges are required. Because TheHive instances are frequently exposed to internal networks or the internet for analyst access, discovery via banner scanning is straightforward.

The vulnerability is documented in the GitHub PoC for TheHive and the VulnCheck Advisory for TheHive.

Detection Methods for CVE-2026-63098

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/status from external or unexpected source addresses
Access log entries showing repeated /api/status queries without a preceding session or authorization header
Reconnaissance patterns pairing /api/status requests with subsequent authentication attempts against enumerated SSO or MFA providers

Detection Strategies

Review TheHive access logs for GET requests to /api/status that lack a valid session cookie or bearer token
Correlate /api/status requests with source IPs that also probe other administrative endpoints such as /api/user or /api/config
Deploy web application firewall (WAF) rules that alert on unauthenticated access to TheHive management endpoints

Monitoring Recommendations

Forward TheHive application logs to a centralized logging platform for retention and alerting
Alert on any external client fetching /api/status outside of scheduled monitoring probes
Track authentication failure spikes following /api/status reconnaissance, indicating credential-based follow-on activity

How to Mitigate CVE-2026-63098

Immediate Actions Required

Restrict network access to TheHive so that /api/status is reachable only from trusted management networks
Place TheHive behind a reverse proxy that requires authentication before proxying requests to /api/status
Rotate the datastore attachment protection password after confirming whether the endpoint was previously exposed
Audit configured authentication providers and enforce MFA on all administrator accounts

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Refer to the VulnCheck Advisory for TheHive for vendor updates and upgrade guidance. Operators should monitor the TheHive project for a release that adds authentication to StatusCtrl.scala.

Workarounds

Block /api/status at the reverse proxy or WAF for all sources except designated monitoring hosts
Require client certificate authentication or IP allowlisting on the ingress path to TheHive
Remove or override the StatusCtrl.scala route in custom deployments where feasible until an upstream patch is available

bash

# Example nginx configuration restricting /api/status access
location /api/status {
    allow 10.0.0.0/8;         # trusted monitoring network
    deny  all;
    proxy_pass http://thehive_backend;
}