CVE-2026-66723 Overview
CVE-2026-66723 is a missing authorization vulnerability [CWE-862] in MWDB Core, the malware repository platform maintained by CERT Polska. The flaw affects the Remote Instances proxy API in versions >=2.2.0 and <2.19.0. The proxy endpoint does not verify authentication on incoming requests, allowing an unauthenticated remote attacker to relay arbitrary requests through the local MWDB instance to a configured remote MWDB instance. The relayed requests execute with the identity and permissions of the API key used to configure the remote instance. The vendor addressed the issue in version 2.19.0.
Critical Impact
Unauthenticated attackers can perform actions on a remote MWDB instance using another user's API key privileges, resulting in high confidentiality and integrity impact on the subsequent system.
Affected Products
- MWDB Core versions >=2.2.0 and <2.19.0
- Deployments with Remote Instances configured
- CERT Polska mwdb-core malware repository platform
Discovery Timeline
- 2026-07-29 - CVE CVE-2026-66723 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-66723
Vulnerability Analysis
MWDB Core supports federation between instances through a Remote Instances feature. Administrators configure a remote MWDB endpoint and an API key that authenticates the local instance to the remote peer. The local instance exposes a proxy API that forwards requests to the remote instance using this stored API key.
The proxy API omits authentication checks on incoming requests. Any network-reachable attacker can invoke the proxy endpoint without credentials. The proxy then attaches the stored API key and forwards the attacker-supplied request to the remote MWDB instance.
The remote instance treats the request as legitimate traffic from the API key owner. Attackers gain the ability to read samples, submit objects, or perform any action the key permits on the remote system. The impact scope shifts from the vulnerable instance to the downstream MWDB peer.
Root Cause
The root cause is a missing authorization check on the Remote Instances proxy handler. The code path that forwards requests does not require the caller to present valid MWDB credentials before it attaches the configured API key and dispatches the request.
Attack Vector
Exploitation requires network access to the MWDB Core proxy endpoint of an instance that has Remote Instances configured. No authentication, user interaction, or privileges are needed on the vulnerable instance. The attacker crafts an HTTP request targeting the proxy route and specifies the desired remote operation. Refer to the GitHub Security Advisory GHSA-942c-r7qj-w895 and the CERT Polska advisory for advisory-level detail.
Detection Methods for CVE-2026-66723
Indicators of Compromise
- Unauthenticated HTTP requests to Remote Instances proxy routes on MWDB Core hosts
- Unexpected activity on remote MWDB peers attributed to the API key used for federation
- Request patterns to the proxy endpoint originating from IP addresses outside the administrator allowlist
- Anomalous sample downloads, uploads, or tag modifications on peer instances tied to a single API key
Detection Strategies
- Review MWDB Core access logs for requests to Remote Instances proxy paths that lack an authenticated session or Authorization header
- Correlate proxy requests on the local instance with actions performed under the federation API key on the remote instance
- Alert on any invocation of the proxy endpoint from unexpected source addresses
Monitoring Recommendations
- Enable verbose HTTP access logging on MWDB Core and forward logs to a central SIEM
- Monitor the audit trail on remote MWDB peers for actions tied to the federation API key and compare against expected federation activity
- Track version inventory to confirm all MWDB Core deployments run 2.19.0 or later
How to Mitigate CVE-2026-66723
Immediate Actions Required
- Upgrade MWDB Core to version 2.19.0 or later on all instances that expose Remote Instances functionality
- Rotate API keys used for Remote Instances federation, since prior keys may have been abused through the proxy
- Restrict network access to the MWDB Core proxy endpoint to trusted administrators and federation peers until patching is complete
Patch Information
The vulnerability is fixed in MWDB Core version 2.19.0. Release notes and the patched code are available in the GitHub mwdb-core v2.19.0 release. Administrators should follow the standard upgrade path documented by CERT Polska and validate that Remote Instances configurations remain intact after the upgrade.
Workarounds
- If upgrading is not immediately possible, disable Remote Instances by removing configured remote endpoints from MWDB Core
- Block external access to proxy API routes at a reverse proxy or firewall, allowing only trusted internal callers
- Revoke the API keys associated with federation until the patched version is deployed and keys can be reissued
# Configuration example: upgrade MWDB Core to the patched release
pip install --upgrade 'mwdb-core>=2.19.0'
# Verify installed version
mwdb-core --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
