CVE-2026-73160: cti-transmute SSRF Vulnerability

CVE-2026-73160 Overview

CVE-2026-73160 is a Server-Side Request Forgery (SSRF) vulnerability in the cti-transmute project maintained by MISP. The flaw affects the /fetch_misp_event and /misp_search_events HTTP endpoints. Both routes accepted user-supplied URLs and issued outbound HTTP requests without adequate destination validation. Anonymous callers could coerce the server into requesting internal network resources and read the returned response. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can pivot through the cti-transmute server to reach internal-only services, exfiltrate metadata, or probe non-routable network segments.

Affected Products

MISP cti-transmute (affected versions prior to the fix commit 4d29109a6f185d5e7c7f3b906f822ab34403f512)
Deployments exposing the /fetch_misp_event route
Deployments exposing the /misp_search_events route

Discovery Timeline

2026-08-11 - CVE-2026-73160 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73160

Vulnerability Analysis

The vulnerability resides in the URL validation logic used by the MISP fetch and search routes in website/web/conversions/conversions.py. The original routine inspected the supplied hostname to determine whether it was an IP literal. When it was, the code rejected private, loopback, link-local, and reserved addresses. However, ordinary DNS hostnames bypassed this filter entirely because the code never resolved them before issuing the outbound request.

An attacker registers or controls a domain whose A record points to an internal address such as 169.254.169.254 or 10.0.0.5. The attacker submits a URL containing that hostname to /fetch_misp_event or /misp_search_events. The server resolves the hostname at request time and connects to the internal target. The response body is returned to the caller. Both routes lacked authentication, allowing anonymous exploitation.

Root Cause

The root cause is incomplete destination validation combined with missing authentication. The urlparse-based check only handled IP literals in the URL string and did not resolve DNS names to verify the actual routable destination. Both endpoints also omitted the @login_required decorator.

Attack Vector

Exploitation requires only network reachability to the cti-transmute web interface. No credentials, user interaction, or elevated privileges are required. The attacker submits a crafted URL parameter pointing to a hostname whose DNS resolution yields a private, loopback, or link-local address. The server then reads and returns the internal resource contents.

python

# website/web/conversions/conversions.py (patch excerpt)
 import ipaddress
 import json
+import socket
 from urllib.parse import urlparse

 from flask import (

Source: GitHub Commit for CTI Transmute

The patch imports socket, calls socket.getaddrinfo() to resolve every hostname, verifies that each returned address is globally routable, and adds @login_required to both routes.

Detection Methods for CVE-2026-73160

Indicators of Compromise

Requests to /fetch_misp_event or /misp_search_events originating from unauthenticated sessions or unexpected source IPs.
Outbound HTTP connections from the cti-transmute host targeting RFC1918 ranges, 127.0.0.0/8, 169.254.0.0/16, or cloud metadata endpoints such as 169.254.169.254.
Web access logs containing URL parameters whose hostnames resolve to private addresses.

Detection Strategies

Correlate application access logs with egress firewall logs to identify server-initiated requests to internal networks following inbound calls to the MISP fetch or search endpoints.
Deploy an authenticated DNS sink that flags resolutions performed by the cti-transmute process for domains that point to internal address space.
Alert on any HTTP 200 responses returned by the affected endpoints when the resolved destination falls outside globally routable ranges.

Monitoring Recommendations

Enable verbose Flask request logging for the /fetch_misp_event and /misp_search_events routes, capturing full URL parameters and session identity.
Monitor the cti-transmute service account for anomalous outbound traffic patterns, especially connections to cloud instance metadata services.
Track authentication state on the affected routes and alert when anonymous requests succeed.

How to Mitigate CVE-2026-73160

Immediate Actions Required

Update cti-transmute to a build that includes commit 4d29109a6f185d5e7c7f3b906f822ab34403f512 or later.
Restrict network egress from the cti-transmute host so it cannot reach internal subnets, loopback, or cloud metadata endpoints.
Require authentication for all cti-transmute routes at the reverse proxy layer if patching is delayed.

Patch Information

The upstream fix is available in the MISP cti-transmute repository. The commit resolves hostnames using socket.getaddrinfo(), verifies that every resolved address is globally routable, and adds @login_required to both the /fetch_misp_event and /misp_search_events handlers. Review the GitHub Commit for CTI Transmute for the full diff.

Workarounds

Place the cti-transmute service behind an authenticating reverse proxy that rejects anonymous access to the affected routes.
Enforce egress filtering that blocks outbound connections from cti-transmute to private, loopback, link-local, and reserved address ranges.
Configure an outbound HTTP proxy that resolves and validates hostnames against an allowlist of external threat intelligence sources.

bash

# Example iptables egress restriction for the cti-transmute host
iptables -A OUTPUT -m owner --uid-owner cti-transmute -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cti-transmute -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cti-transmute -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cti-transmute -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cti-transmute -d 127.0.0.0/8 -j REJECT