CVE-2026-66724: MWDB Core Auth Bypass Vulnerability

CVE-2026-66724 Overview

CVE-2026-66724 is a missing authorization vulnerability [CWE-862] in MWDB Core, the malware repository platform maintained by CERT Polska. The flaw affects versions >=2.0.0 and <2.19.0. Deprecated config and blob upload endpoints accept an undocumented POST method that bypasses the capability checks enforced on the documented PUT method. Any authenticated user can upload config and text blob objects without holding the adding_configs or adding_blobs capabilities. The impact is scoped to adding new config and blob objects. CERT Polska addressed the issue in MWDB Core version 2.19.0.

Critical Impact
Authenticated users without upload capabilities can inject arbitrary config and blob objects into the MWDB repository, polluting analyst-facing threat intelligence data.

Affected Products

MWDB Core >=2.0.0 and <2.19.0
CERT-Polska/mwdb-core deprecated config upload endpoint
CERT-Polska/mwdb-core deprecated blob upload endpoint

Discovery Timeline

2026-07-29 - CVE CVE-2026-66724 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66724

Vulnerability Analysis

MWDB Core exposes deprecated REST endpoints for uploading configuration objects and text blobs. The documented interface uses the PUT method, which routes through capability checks that verify the caller holds either the adding_configs or adding_blobs capability. The deprecated endpoints also accept an undocumented POST method that does not pass through the same authorization guard. Authenticated low-privilege users can invoke the POST variant and successfully create new config or blob objects, sidestepping the role-based capability model.

The consequence is corruption of the malware knowledge base. Attackers with valid MWDB accounts can seed the repository with fabricated indicators, misleading configuration entries, or spoofed text artifacts that downstream analysts and automation may consume as authoritative threat intelligence. Confidentiality and availability are not directly affected; integrity of stored config and blob objects is the primary concern.

Root Cause

The vulnerability stems from inconsistent method-level authorization on the deprecated upload routes. The capability decorator was applied to the PUT handler but not to the co-located POST handler. This is a classic broken access control pattern where an alternate HTTP verb reaches the same underlying create logic while bypassing the authorization middleware.

Attack Vector

Exploitation requires network access to the MWDB Core API and valid authenticated credentials for any user account, regardless of assigned capabilities. The attacker issues a POST request to the deprecated config or blob upload endpoint with a valid session or API token. The server processes the request and persists the object without checking adding_configs or adding_blobs. No user interaction is required. See the GitHub Security Advisory GHSA-8fv8-wffg-4323 and the CERT Polska advisory post for additional technical context.

Detection Methods for CVE-2026-66724

Indicators of Compromise

Unexpected POST requests targeting deprecated config or blob upload endpoints in MWDB Core access logs.
New config or blob objects attributed to user accounts that lack the adding_configs or adding_blobs capability.
Sudden growth in the config or blob object tables without a corresponding change in analyst workflow.

Detection Strategies

Review MWDB Core application and reverse-proxy logs for POST requests to legacy config and blob upload paths.
Correlate uploader identity with the user's assigned capability set in the MWDB database to surface authorization mismatches.
Alert on the use of the deprecated POST verb on endpoints that documentation restricts to PUT.

Monitoring Recommendations

Ingest MWDB Core HTTP access logs into a centralized log platform and retain them for post-incident review.
Monitor for anomalous object creation rates per user account and alert on outliers.
Track MWDB Core version strings across deployments to identify hosts still running versions below 2.19.0.

How to Mitigate CVE-2026-66724

Immediate Actions Required

Upgrade all MWDB Core instances to version 2.19.0 or later.
Audit existing config and blob objects created by accounts without adding_configs or adding_blobs capabilities and remove any unauthorized entries.
Rotate API tokens for accounts that may have been used to exploit the deprecated endpoints.

Patch Information

CERT Polska released the fix in the MWDB Core v2.19.0 release. The patch aligns the deprecated POST handler with the same capability checks enforced on the documented PUT handler. Refer to the GitHub Security Advisory GHSA-8fv8-wffg-4323 for the complete advisory record.

Workarounds

Block POST requests to deprecated config and blob upload endpoints at an upstream reverse proxy until the upgrade to 2.19.0 is completed.
Restrict MWDB Core API access to trusted networks and limit account creation to vetted analysts.
Reduce the number of active user accounts to the minimum required for operations while the patch is being rolled out.

bash

# Configuration example
# Example nginx snippet blocking POST on deprecated MWDB upload endpoints
location ~ ^/api/(config|blob)$ {
    if ($request_method = POST) {
        return 405;
    }
    proxy_pass http://mwdb_backend;
}