Which versions of MWDB Core are affected by CVE-2026-66723?

MWDB Core versions 2.2.0 through 2.18.x contain an access control flaw in the Remote Instances proxy API that permits unauthenticated attackers to relay requests to connected malware databases using…. A patch is available.

How to fix or mitigate CVE-2026-66723?

Within 24 hours, complete an inventory of all MWDB Core deployments in your environment and immediately restrict network access to the Remote Instances proxy API to trusted internal sources only; disable remote instance functionality entirely if operationally feasible. Within 7 days, apply vendor-released patch to upgrade all affected MWDB Core instances to version 2.19.0 or later, conducting staged testing in non-production environments to validate remote instance functionality post-upgrade. Within 30 days, rotate all API credentials used for remote MWDB instance authentication, conduct access log reviews across all previously vulnerable versions to identify unauthorized relay requests or exploit attempts, and update your security incident register and remediation documentation.

MWDB Core CVE-2026-66723

Q: What is the CVSS score of CVE-2026-66723?

CVE-2026-66723 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-50359 HIGH

Missing Authorization (CWE-862)

2026-07-29 CERT-PL

Authentication Bypass Mwdb Core

7.0

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Unauthenticated network proxy abuse (PR:N/AV:N) but only where Remote Instances are configured, hence AC:H; impact falls on the separate remote instance (S:C) with high C/I and no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 29, 2026 - 15:17 vuln.today

Analysis Generated

Jul 29, 2026 - 15:17 vuln.today

CVE Published

Jul 29, 2026 - 14:12 cve.org

HIGH 7.0

DescriptionCVE.org

MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key. This can result in unauthorized actions being performed on the remote instance as if executed by the user whose API key was used to set up the remote instance. The vulnerability is limited to deployments where Remote Instances have been configured.This issue has been fixed in version 2.19.0

AnalysisAI

Missing authorization in MWDB Core's Remote Instances proxy API (versions >=2.2.0 to <2.19.0) lets an unauthenticated remote attacker relay arbitrary requests to a linked remote MWDB instance, executing them with the identity and permissions of the API key configured for that remote link. This effectively impersonates the API-key owner on the remote instance and enables unauthorized actions there. No public exploit identified at time of analysis; the flaw was reported by CERT-PL and is fixed in 2.19.0.

Technical ContextAI

MWDB Core is CERT Polska's open-source malware repository and analysis backend (Python/Flask) used to store, tag, and share malware samples and configs across trusted parties. Its Remote Instances feature lets one MWDB deployment proxy operations to another MWDB server, authenticating outbound requests with a stored API key belonging to a specific user. The root cause is CWE-862 (Missing Authorization): the local proxy endpoints that forward these requests did not enforce authentication/authorization on the *inbound* caller, so any client reaching those endpoints could ride the pre-configured API key. The v2.19.0 fix (PR #1247) adds a proper authorization requirement to the Remote API endpoints; a related hardening (PR #1248) removed undocumented POST methods on legacy /config and /blob endpoints.

RemediationAI

Vendor-released patch: 2.19.0 - upgrade MWDB Core to v2.19.0 or later, which adds the missing authorization checks to the Remote API endpoints (PR #1247) and also removes unintended POST methods on the legacy /config/<parent_dhash> and /blob/<parent_dhash> endpoints (PR #1248, GHSA-8fv8-wffg-4323). If immediate upgrade is not possible, disable or remove configured Remote Instances so the vulnerable proxy path cannot be abused (trade-off: this breaks cross-instance federation/sharing until restored), and restrict network access to the MWDB host so only trusted operators can reach the proxy endpoints. Rotating the API keys used to establish remote links after patching is prudent since they may have been abused. See the advisory at https://github.com/CERT-Polska/mwdb-core/security/advisories/GHSA-942c-r7qj-w895 and https://cert.pl/en/posts/2026/07/CVE-2026-66723.