TheHive CVE-2026-63098

TheHive must be running a version at or below 4.1.24, and the /api/status endpoint must be network-reachable from the attacker - this is the case in any internet-facing or intranet-accessible deployment, as the endpoint is present in the default installation with no special configuration required to enable it. No authentication, no specific feature flag, and no non-default configuration is needed; the vulnerability exists in the default StatusCtrl.scala handler present in all affected installations. Exploitation is limited by: the attacker requiring network-layer reachability to the TheHive HTTP port (if isolated to localhost or behind strict firewall rules, the attack surface is reduced); and the severity of exposed data varying based on what is actually configured in the deployment (e.g., a deployment without SSO exposes less than one with full federated identity configured). Authentication is confirmed not required per the CVSS 4.0 PR:N metric.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N reflects low attack complexity and zero authentication requirement, meaning exploitation is reachable by any actor with network access. The overall score of 6.9 is bounded by VC:L (low confidentiality impact on the vulnerable system), which may understate operational risk: the exposed datastore attachment protection password and SSO/authentication provider configuration are high-value pivot credentials that could enable further compromise of connected infrastructure. The publicly available POC on GitHub substantially elevates real-world risk, reducing exploitation difficulty to trivial levels accessible to low-skilled attackers. No EPSS score was provided in the input data; no CISA KEV listing is present, suggesting opportunistic rather than confirmed targeted exploitation at time of analysis. The absence of an integrity or availability vector confirms this is a pure disclosure flaw - but defenders should treat the disclosed credentials as compromised and rotate them immediately regardless of whether active exploitation is confirmed.

An unauthenticated attacker identifies a network-accessible TheHive instance and issues a single HTTP GET request to /api/status, receiving a JSON response containing the datastore attachment protection password, SSO configuration, authentication provider list, MFA capability flags, and cluster node roles. A public POC hosted on GitHub documents this exact technique, making it reachable by low-skilled attackers. The attacker then uses the exposed datastore password or SSO configuration parameters to attempt authentication bypass or credential reuse against connected systems in the SOC infrastructure.