MISP Modules CVE-2026-112991

Requires (1) an authenticated MISP account with privilege to create or modify attributes, and (2) the html_to_markdown expansion module being enabled and reachable so the supplied URL is fetched server-side. Exploitation specifically abuses URLs in the ranges the original BLOCKED_RANGES omitted - 0.0.0.0/8 (routes to loopback on Linux), 100.64.0.0/10 (RFC 6598 CGNAT), ::/128, fc00::/7 (IPv6 ULA), fe80::/10 (IPv6 link-local), plus IPv4-mapped IPv6 forms like [::ffff:0.0.0.0]. Limiting factors: no unauthenticated access (PR:L), the target expansion module must be configured/active, and impact is confined to reading reachable internal services - the MISP host is not directly compromised and there is no write/integrity or availability effect.

This is a genuine but moderate-priority SSRF (CWE-918). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires PR:L - an authenticated MISP user - so this is not an unauthenticated internet-facing bug. The severity is driven entirely by subsequent-system confidentiality (SC:H) while vulnerable-system impact is nil (VC:N/VI:N/VA:N), consistent with the description stating MISP itself is not compromised but is abused as a proxy. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS was not provided. No SSVC decision data was supplied. Signals are internally consistent (no CVSS-vs-description conflict), but the real-world risk is gated by two factors the raw score understates: the attacker must already hold MISP attribute-creation privileges, and the html_to_markdown expansion module must be enabled and triggerable. Net: a credible insider/compromised-account internal-reconnaissance risk worth patching, not a drop-everything externally-exploitable emergency.

An authenticated MISP user (or an attacker who has phished/compromised a low-privilege MISP account) creates or edits an attribute whose value triggers the html_to_markdown expansion module, supplying a URL such as http://0.0.0.0/, http://[fc00::1]/ or http://100.64.0.1/ that points at an internal or link-local service. The MISP server fetches the URL server-side and returns the fetched HTML-to-Markdown content, letting the attacker read responses from internal admin panels, cloud metadata-adjacent services, or carrier-grade NAT infrastructure unreachable from outside. No public exploit code is identified, but the fix commit's test cases demonstrate the exact bypass payloads.