Is there a patch available for CVE-2026-44363?

Yes, a patch is available for CVE-2026-44363. Update the affected software to the latest version immediately.

MISP Modules CVE-2026-44363

Q: What is the CVSS score of CVE-2026-44363?

CVE-2026-44363 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Certificate Validation (CWE-295)

2026-05-06 https://github.com/MISP/misp-modules

GHSA-fhq3-2gf3-8f3j

SSRF

5.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network-reachable MISP API typically requires low-privilege credentials; SSRF changes scope with high confidentiality impact on subsequent internal systems and low integrity impact via qrcode MitM.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:11 vuln.today

Analysis Generated

Jul 23, 2026 - 23:11 vuln.today

CVSS changed

May 13, 2026 - 20:22 NVD

5.8 (MEDIUM)

CVE Published

May 06, 2026 - 22:31 nvd

MEDIUM

DescriptionGitHub Advisory

An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. As reported by Bilal Teke.

AnalysisAI

SSRF in MISP Modules' html_to_markdown expansion module (misp-modules ≤ 3.0.7) allows an attacker to redirect server-side HTTP requests to loopback, RFC 1918, or link-local addresses, exposing internal infrastructure to enumeration and data exfiltration. The qrcode module independently disabled TLS certificate verification when fetching remote images, enabling a network-adjacent party to intercept or tamper with those responses. No public exploit has been identified at time of analysis; EPSS sits at the 1st percentile, and no CISA KEV listing exists, indicating low observed exploitation activity despite real-world risk in privileged-network MISP deployments.

Technical ContextAI

MISP Modules is the Python-based expansion module framework for the Malware Information Sharing Platform, distributed via PyPI as pip/misp-modules. The two affected components are the html_to_markdown and qrcode expansion modules. The html_to_markdown module issued server-side HTTP(S) requests to arbitrary caller-supplied URLs without pre-resolving hostnames or filtering RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) address ranges - the standard SSRF enabler class. The qrcode module disabled TLS certificate verification (CWE-295, Improper Certificate Validation) when retrieving remote images, stripping the peer-authentication guarantee of the TLS handshake and opening those requests to interception or response substitution by network-adjacent attackers. The upstream fix in commit 01a522f2 introduces URL scheme allowlisting, pre-fetch hostname resolution against a private-range blocklist, enforced request timeouts, and re-enabled TLS certificate verification, addressing both issues.

RemediationAI

Apply the upstream patch commit 01a522f2772fc31eeed379ccf23750c8a3d401db from https://github.com/MISP/misp-modules/commit/01a522f2772fc31eeed379ccf23750c8a3d401db. The GHSA advisory at https://github.com/MISP/misp-modules/security/advisories/GHSA-fhq3-2gf3-8f3j does not list a fixed tagged release version, so teams should apply the patch manually or pin to a post-commit build until an official release is published. As a compensating control for the SSRF, enforce outbound firewall rules on the MISP server that block HTTP connections to RFC 1918, loopback (127.0.0.0/8), and link-local (169.254.0.0/16) ranges - this eliminates the primary SSRF impact regardless of code state, though it may break legitimate enrichment workflows that intentionally fetch from internal resources. For the TLS bypass in qrcode, deploy the MISP server in a network segment that routes image-fetch traffic through a TLS-inspecting proxy, which provides independent certificate validation as a compensating control. Additionally, segment the MISP host to minimize lateral reach to high-value internal services, reducing the blast radius of any SSRF exploitation.