cti-transmute CVE-2026-73160

The /fetch_misp_event or /misp_search_events endpoints must be reachable by the attacker over the network. Prior to the fix, both endpoints were unauthenticated - the CVSS PR:N metric and the commit's explicit statement that 'anonymous callers' could trigger the SSRF confirm this. The attacker must control or influence the DNS A record of a domain to resolve to a private, loopback, or reserved IP address. The cti-transmute server must be permitted to resolve external DNS names and issue outbound network requests to the internal target. No special non-default application configuration, user interaction, or specific platform version beyond running an unpatched cti-transmute instance is required. Exploitation is limited to confidentiality impact against systems reachable from the cti-transmute server's network interface; direct integrity or availability impact on the vulnerable system is not supported by the available data.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N) accurately reflects the pre-patch state: a zero-complexity, unauthenticated network call with confirmed ability to read internal service responses. The PR:N metric is corroborated by the commit description explicitly stating that anonymous callers could trigger the SSRF and receive response bodies. No EPSS data was supplied, but the technique is well-understood and requires no specialized tooling, meaning real-world exploitability is high for any internet-exposed deployment. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified, which somewhat moderates urgency, but even a mid-sized municipal IT team in kalisz running an exposed cti-transmute instance should treat this as a priority given that the confidentiality impact extends to the server's entire internal network reachability. The SC:L subsequent-system metric in the CVSS 4.0 vector acknowledges a residual TOCTOU risk identified in the fix's own comments: after patching, DNS races could still leak port/service existence via differing TLS error shapes, though the response body itself cannot be exfiltrated due to TLS certificate enforcement and redirect refusal in the internal request function. The dual fix - resolving hostnames before validating AND enforcing authentication - is the correct layered response, but operators who have not yet patched face an unauthenticated, trivially exploitable path to internal network enumeration and data exfiltration.

An unauthenticated attacker with HTTP access to a cti-transmute instance registers a domain (e.g., internal-probe.attacker.com) and sets its DNS A record to point to an internal IP such as 192.168.1.1 or the AWS instance metadata endpoint at 169.254.169.254. The attacker sends a single HTTP request to /fetch_misp_event supplying internal-probe.attacker.com as the MISP URL; the server resolves the domain, passes it through the IP-literal-only validation check, and issues an outbound HTTPS request to the internal target, returning the response body to the attacker. No public exploit code has been identified, but the technique requires only standard HTTP tooling and a DNS record under attacker control.