Vulnerability Description
Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain names were accepted without resolving them first. An attacker could therefore use a hostname whose DNS record pointed to an internal address and cause the cti-transmute server to issue requests into its internal network. The commit explicitly states that anonymous callers could make the server request the internal target and read the response. The fix resolves hostnames using socket.getaddrinfo(), checks that every resolved address is globally routable, and additionally places @login_required on both affected MISP fetch/search routes.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-73160?
CVE-2026-73160 is a documented vulnerability. Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_misp_event and /misp_search_events endpoints. The URL validation routine checked whether a supplied hostname was itself...
How severe is CVE-2026-73160?
CVSS scoring is not yet available for CVE-2026-73160. Check NVD for updates.
Is there a patch for CVE-2026-73160?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.