CVE-2026-69079: CTI-Transmute DOS Vulnerability

CVE-2026-69079 Overview

CVE-2026-69079 is an uncontrolled resource-consumption vulnerability [CWE-770] in CTI-Transmute, a MISP-affiliated web application for cyber threat intelligence transformation. The flaw resides in the unauthenticated /activity_timeline endpoint, which accepts a user-controlled days query parameter without upper-bound validation.

A remote attacker can submit an excessively large value for days, forcing the application to retrieve and process activity data over an arbitrarily long time range. This consumes disproportionate database, CPU, and memory resources, degrading availability for concurrent users.

Critical Impact
An unauthenticated remote attacker can trigger denial-of-service conditions against CTI-Transmute by sending crafted requests to /activity_timeline with an oversized days parameter, exhausting backend resources.

Affected Products

CTI-Transmute (MISP project) — versions prior to commit 321892d
Deployments exposing the /activity_timeline endpoint without upstream rate limiting
Any instance where the endpoint remains accessible without authentication

Discovery Timeline

2026-08-03 - CVE CVE-2026-69079 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69079

Vulnerability Analysis

The vulnerability exists in website/web/evaluate/evaluate.py within the activity_timeline Flask route. The endpoint parses a days query parameter and passes it directly to EvalModel.get_activity_timeline(days=days) without validating the upper bound. The default value is 30, but the parameter accepts any integer.

When the value is arbitrarily large, the backend query iterates over an unbounded time window and returns a proportionally large result set. This maps directly to CWE-770: Allocation of Resources Without Limits or Throttling. Because the route is unauthenticated, an attacker does not need credentials, cookies, or session state to reach the sink.

Repeated concurrent requests amplify the effect, saturating the database connection pool and worker processes. Legitimate users experience delayed responses or 500 Internal Server Error conditions.

Root Cause

The root cause is missing input validation on the days query parameter. Flask's request.args.get("days", 30, type=int) performs type coercion but not range enforcement. The application assumed clients would submit reasonable values but did not defend against adversarial input.

Attack Vector

The attack requires only network access to the CTI-Transmute web interface. An attacker issues an HTTP GET request such as GET /activity_timeline?days=99999999 and repeats it concurrently. Each request forces a full historical scan against the activity data store.

python

 @evaluate_blueprint.route("/activity_timeline")
 def activity_timeline():
     days = request.args.get("days", 30, type=int)
+    days = max(1, min(days, 1095))  # Max 3 years (unauthenticated route)
     data = EvalModel.get_activity_timeline(days=days)
     return {"success": True, "timeline": data}, 200

Source: GitHub Commit for CTI Transmute

The patch clamps days to a minimum of 1 and a maximum of 1,095 (three years) before passing the value to the model layer.

Detection Methods for CVE-2026-69079

Indicators of Compromise

HTTP GET requests to /activity_timeline with a days query parameter exceeding 1,095
Repeated requests to the same endpoint from a single source IP within a short window
Elevated database query latency correlated with requests to /activity_timeline
Application logs containing 500 Internal Server Error responses from the evaluate blueprint

Detection Strategies

Parse web server access logs for /activity_timeline requests and alert on days values above the patched ceiling of 1,095
Correlate spikes in CPU, memory, or database connection usage with request patterns against the evaluate blueprint
Track HTTP 5xx error rates on the CTI-Transmute frontend as a leading indicator of resource exhaustion

Monitoring Recommendations

Enable structured request logging on the reverse proxy fronting CTI-Transmute to capture full query strings
Instrument application-level metrics for query duration and result set size on get_activity_timeline
Configure alerts on sustained request volume to unauthenticated endpoints from single sources

How to Mitigate CVE-2026-69079

Immediate Actions Required

Apply the upstream patch by updating CTI-Transmute to a build that includes commit 321892d26b82c8a5af1e210ee30735abb109fac2
Place CTI-Transmute behind a reverse proxy that enforces rate limiting on /activity_timeline
Restrict network exposure of the endpoint to trusted analysts where operationally possible
Review historical logs for prior exploitation attempts against the endpoint

Patch Information

The fix is committed to the MISP CTI-Transmute repository. The patch clamps the days parameter to max(1, min(days, 1095)) before it reaches EvalModel.get_activity_timeline. Refer to the GitHub Commit for CTI Transmute for the authoritative change.

Workarounds

Enforce a request rate limit on /activity_timeline at the reverse proxy or web application firewall layer
Add a WAF rule that rejects requests where the days query parameter exceeds 1,095 or is non-numeric
Require authentication in front of CTI-Transmute using an upstream identity-aware proxy until the patch is deployed

bash

# nginx example: rate-limit and cap the days parameter
limit_req_zone $binary_remote_addr zone=cti_timeline:10m rate=5r/m;

location = /activity_timeline {
    limit_req zone=cti_timeline burst=5 nodelay;
    if ($arg_days ~* "^[0-9]{5,}$") { return 400; }
    proxy_pass http://cti_transmute_upstream;
}