Skip to navigation

Threat reportVulnerabilityTL-2026-1821

CVE-2026-66723: Missing Authorization in MWDB Core Remote Instances Proxy API

highACTIVE

MWDB Core (CERT Polska's malware-sample/threat-intel repository, versions 2.2.0 through 2.18.x) contains a missing-authorization flaw (CWE-862, CVSS 4.0 7.0/High) in its Remote Instances proxy API: the endpoint that forwards local requests to a configured remote MWDB instance does not verify that the incoming request is authenticated, letting an unauthenticated attacker send arbitrary requests to the remote instance under the identity and permissions of the configured API key.

Key facts for MWDB Core remote proxy flaw

IdentifiersTL-2026-1821, CVE-2026-66723, CVE-2026-66724
Also known asGHSA-942c-r7qj-w895
SeverityHIGH
CVSS7 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N)
Exploitation statusNo exploitation observed (theoretical)
EPSSCVE-2026-66723: 0.4% (39.7th percentile); CVE-2026-66724: 0.4% (36.1th percentile)
Affected productsCERT Polska MWDB Core
Weaknesses (CWE)CWE-862
ToolsMWDB Core, mwdblib
MITRE ATT&CK techniquesT1005 Data from Local System, T1046 Network Service Discovery, T1068 Exploitation for Privilege Escalation, T1078 Valid Accounts, T1119 Automated Collection, T1190 Exploit Public-Facing Application, T1199 Trusted Relationship, T1210 Exploitation of Remote Services, T1211 Exploitation for Stealth, T1213 Data from Information Repositories, T1518 Software Discovery, T1550 Use Alternate Authentication Material and 4 more in the attack flow
MotivationUNKNOWN
Target sectorsgovernment administration, technology
Target regionsGlobal, Europe
Detection rules9 (1 shown free)
Sources16 cited sources

Detection coverage for MWDB Core remote proxy flaw

As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1821 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MWDB Core Remote Instances Proxy — Unauthenticated Confused-Deputy Request (SPL)

Detects HTTP requests reaching the MWDB Core Remote Instances generic proxy endpoint (/api/remote/<remote_name>/api/<path>, the RemoteAPIResource Flask class) that carry no Authorization header yet still receive a successful (2xx) response — the exact signature of CVE-2026-66723 (CWE-862): RemoteAPIResource forwards the call to the remote instance using the locally-configured API key without first checking that the caller is an authenticated local user.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1199, T1550.001
  • Data sources: mwdb_core_application_access_log, reverse_proxy_access_log
  • Severity: high
  • Confidence: high

Splunk SPL

index=web sourcetype="mwdb:proxy:access" earliest=-24h
| regex uri_path="\/api\/remote\/[^\/]+\/api\/.*"
| eval auth_present=if(isnotnull(authorization_header) AND len(authorization_header)>0,1,0)
| where auth_present=0 AND status>=200 AND status<300
| stats count as hit_count, min(_time) as first_seen, max(_time) as last_seen, values(uri_path) as paths, values(remote_name) as remotes by src_ip
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| where hit_count>=1
| table src_ip, remotes, paths, hit_count, first_seen, last_seen
| sort -hit_count

Microsoft KQL

MWDBCoreAccessLog_CL
| where TimeGenerated > ago(24h)
| where RequestPath_s matches regex @"/api/remote/[^/]+/api/.*"
| where isempty(AuthorizationHeaderPresent_b) or AuthorizationHeaderPresent_b == false
| where ResponseStatusCode_d >= 200 and ResponseStatusCode_d < 300
| summarize HitCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Paths = make_set(RequestPath_s), Remotes = make_set(RemoteInstanceName_s) by ClientIP_s
| where HitCount >= 1
| project ClientIP_s, Remotes, Paths, HitCount, FirstSeen, LastSeen
| order by HitCount desc

Sigma

title: MWDB Core Remote Instances Proxy Called Without Authorization Header
id: 6f2a9c3e-1b7d-4e5a-9c8f-1821000000a1
status: experimental
description: Detects HTTP requests reaching the MWDB Core Remote Instances generic proxy endpoint (/api/remote/<remote_name>/api/<path>, RemoteAPIResource) with no Authorization header that still receive a 2xx response, consistent with CVE-2026-66723 (CWE-862) confused-deputy exploitation.
references:
    - https://cert.pl/en/posts/2026/07/CVE-2026-66723/
    - https://github.com/CERT-Polska/mwdb-core/security/advisories/GHSA-942c-r7qj-w895
    - https://github.com/CERT-Polska/mwdb-core/pull/1247
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-02
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1199
    - attack.defense-evasion
    - attack.t1550.001
    - cve.2026.66723
logsource:
    category: webserver
    product: mwdb-core
detection:
    selection_path:
        cs-uri-stem|contains: '/api/remote/'
        cs-uri-stem|re: '.*/api/remote/[^/]+/api/.*'
    selection_status:
        sc-status|startswith: '2'
    filter_authorized:
        cs-Authorization|exists: true
    condition: selection_path and selection_status and not filter_authorized
falsepositives:
    - Reverse proxy or load balancer misconfiguration stripping the Authorization header before requests reach MWDB Core
    - Monitoring/health-check probes hitting unrelated /api/remote/ list endpoints without credentials by design
level: high

Known false positives:

  • A misconfigured reverse proxy or load balancer strips the Authorization header before it reaches MWDB Core, making legitimate authenticated calls appear header-less
  • Health-check or monitoring probes hitting unrelated /api/remote/ list endpoints without credentials by design

Tuning notes: Baseline the expected remote_name values from mwdb.ini and alert only on unexpected remote/path combinations; verify with a known-good authenticated call that the reverse proxy is not stripping Authorization headers before treating hits as true positives; exclude known health-check source IPs.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • MWDB Core Remote Instances Proxy — Unauthenticated Confused-Deputy Request (KQL) · unlock with TL Creds
  • MWDB Core Remote Pull / Legacy Upload Capability Bypass (KQL) · unlock with TL Creds
  • MWDB Core Confused-Deputy Egress — Unauthenticated Inbound Triggers Authenticated Outbound to Remote Instance (KQL) · unlock with TL Creds
  • MWDB Core Remote Instances Proxy — Unauthenticated Confused-Deputy Request (Sigma) · unlock with TL Creds
  • MWDB Core Remote Pull / Legacy Upload Capability Bypass (Sigma) · unlock with TL Creds
  • MWDB Core Confused-Deputy Egress — Unauthenticated Inbound Triggers Authenticated Outbound to Remote Instance (Sigma) · unlock with TL Creds
  • MWDB Core Remote Pull / Legacy Upload Capability Bypass (SPL) · unlock with TL Creds
  • MWDB Core Confused-Deputy Egress — Unauthenticated Inbound Triggers Authenticated Outbound to Remote Instance (SPL) · unlock with TL Creds

Indicators of compromise for MWDB Core remote proxy flaw

As of 2026-07-29, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-1821.

30 indicators of compromise · unlock with TL Creds. Compare plans

How MWDB Core remote proxy flaw works

Fixed in 2.19.0.

MWDB Core is an open-source malware repository and threat-intelligence sharing platform, developed and operated by CERT Polska (also run publicly at mwdb.cert.pl), used by CSIRTs, SOC teams, and malware analysts to store samples, static/dynamic configurations, and their relationships behind a REST API.

Since milestone 2.2.0, MWDB Core has shipped an experimental 'Remote Instances' feature that lets a local deployment act as an authenticating proxy toward one or more remote MWDB deployments. An operator configures each remote in mwdb.ini under a '[remote:<name>]' section with a 'url' and an 'api_key', and lists the remote names in a 'remotes' directive. Once configured, the local instance exposes several endpoints under '/api/remote/': 'GET /api/remote/' lists configured remotes; '/api/remote/<remote_name>/<type>/<id>/pull' and '.../push' transfer individual objects (samples, configs, blobs) between local and remote; and a generic '<method> /api/remote/<remote_name>/api/<path>' endpoint forwards arbitrary API calls to the remote instance, attaching the locally configured API key so the request executes on the remote with that key's identity and permissions.

CVE-2026-66723 (CWE-862, Missing Authorization) is a flaw in this last, generic proxy endpoint: it fails to verify that the caller of '/api/remote/<remote_name>/api/<path>' is themselves an authenticated user of the local instance before forwarding the request. As a result, any unauthenticated network attacker who can reach the local MWDB instance can send arbitrary API calls through the proxy and have them executed against the remote instance with the full rights of the remote's configured API key — a classic confused-deputy / broken-access-control pattern. Because the remote API key is typically provisioned with broad rights (to pull/push malware samples and configurations), impact can include unauthorized reading of sensitive malware samples and configs, and potentially data-manipulation actions (e.g., pushing/tagging objects) on the remote repository, all attributable to the legitimate key holder rather than the true attacker.

The fix, delivered in two pull requests merged the same day the advisory was published, clarifies the exact vulnerable surface. PR #1247 ('fix/remote-api-missing-auth') added the missing authentication/authorization checks to two Flask resource classes: `RemoteAPIResource` (the generic `/api/remote/<remote_name>/api/<path>` forwarder, which had no check that the caller was an authenticated local user before proxying) and `RemotePullResource` (the `/api/remote/<remote_name>/<type>/<id>/pull` handler, which separately failed to verify the caller held the capability required to add an object of the pulled type — meaning even the 'pull' path could let an under-privileged or unauthenticated caller inject sample/config/blob objects into the local repository under types they were not entitled to create). PR #1248 ('fix/remove-legacy-post-method', commit 1d3204b) fixed the sibling CVE-2026-66724 (CWE-862, CVSS v4.0 5.3/Medium; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N; affects versions >=2.0.0, <2.19.0) by making the legacy `/api/config/<dhash>` and `/api/blob/<dhash>` endpoints return HTTP 405 for POST requests, closing an undocumented method that bypassed the `adding_configs`/`adding_blobs` capability checks enforced on the documented PUT method.

The vulnerability only affects deployments that have the Remote Instances feature configured (non-default); CERT Polska's own advisory describes the feature itself as 'undercooked and experimental' and slated for deprecation/removal in a future major release, noting that by design authenticated local users already share the same identity as the remote user associated with the API key. Both issues were fixed together in MWDB Core 2.19.0, published 2026-07-29, credited to reporter psrok1 with contributor dev-cti. No public exploitation, exploit code, or KEV listing has been observed for either CVE as of this writing; CERT Polska's advisory frames both as internally discovered, coordinated-disclosure findings rather than in-the-wild attacks.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories

Discovery

T1046 Network Service Discovery; T1518 Software Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

lateral-movement

T1550 Use Alternate Authentication Material

Impact

T1565 Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1595 Active Scanning

Remediation for MWDB Core remote proxy flaw

Patches

  • MWDB Core 2.19.0 adds an authorization requirement to the Remote Instances proxy API (GHSA-942c-r7qj-w895, PR #1247 'fix/remote-api-missing-auth', fixing checks on RemoteAPIResource and RemotePullResource) and removes the undocumented POST method on deprecated config/blob upload endpoints (GHSA-8fv8-wffg-4323, CVE-2026-66724, PR #1248 'fix/remove-legacy-post-method', commit 1d3204b)

Immediate actions

  • Upgrade MWDB Core to version 2.19.0 or later
  • If unable to patch immediately, remove the 'remotes' directive and all '[remote:<name>]' sections from mwdb.ini to disable the vulnerable Remote Instances proxy entirely
  • Audit and, if exposure to the unauthenticated proxy cannot be ruled out, rotate any API keys configured for Remote Instances

Workarounds

  • Disable the Remote Instances feature by removing its configuration sections from mwdb.ini until the instance can be upgraded to 2.19.0+

Longer-term hardening

  • Enforce authentication checks on all proxy/gateway-style endpoints as a standard code-review gate for CWE-862-class regressions
  • Restrict network exposure of MWDB Core management/API interfaces to trusted networks (VPN/allowlist) rather than the open internet
  • Monitor Remote Instances proxy logs for unauthenticated or anomalous calls to '/api/remote/<name>/api/<path>' and '/api/remote/<name>/<type>/<id>/pull'
  • Apply least-privilege scoping to Remote Instance API keys so a compromised proxy exposes the minimum possible remote capability
  • Reject non-PUT methods on legacy single-object upload endpoints ('/api/config/<dhash>', '/api/blob/<dhash>') as a general defense against undocumented-method authorization bypass

Affected and fixed versions

  • CERT Polska — MWDB Core
    Vulnerable versions: >=2.2.0, <2.19.0
    Fixed in: 2.19.0

Timeline of MWDB Core remote proxy flaw

  • Threat identified via the locked-ioc-18 RSS feed and ingested into the TL-Intel Harness backlog for hunt/research processing.
  • CVE-2026-66723 published in the NVD with CVSS v4.0 base score 7.0 (High) and classified under CWE-862 (Missing Authorization), CNA CERT.PL.
  • PR #1248 ('fix/remove-legacy-post-method', single commit 1d3204b) merged into locked-ioc-19 master, making the legacy locked-ioc-9 and locked-ioc-14 endpoints return HTTP 405 for POST requests, resolving CVE-2026-66724.
  • PR #1247 ('fix/remote-api-missing-auth') merged into locked-ioc-19 master, adding missing authentication/authorization checks to the locked-ioc-15 (generic proxy forwarder) and locked-ioc-12 (object-pull handler) Flask resource classes, resolving CVE-2026-66723.
  • Sibling GitHub Security Advisory locked-ioc-11 for CVE-2026-66724 (CVSS 4.0 5.3, Medium; undocumented POST method bypassing capability checks on legacy config/blob endpoints, affecting versions >=2.0.0 <2.19.0) published in the same coordinated-disclosure batch.
  • GitHub Security Advisory locked-ioc-10 ('Missing authentication requirement in Remote Instances proxy API', High severity, CVSS 4.0 7.0) published on CERT-Polska/locked-ioc-19, credited to reporter locked-ioc-23.
  • locked-ioc-20 2.19.0 released, adding an authorization requirement to the Remote Instances proxy API (fixing CVE-2026-66723) and removing the undocumented POST method on deprecated config/blob upload endpoints (fixing CVE-2026-66724).
  • locked-ioc-18 (own research) publicly discloses the advisory 'Vulnerabilities in locked-ioc-20 software', covering CVE-2026-66723 and sibling CVE-2026-66724.
  • NVD record for CVE-2026-66723 last modified, confirming the CVSS v4.0 7.0 (High) score, CWE-862 classification, and reference set (locked-ioc-18 advisory, locked-ioc-10, locked-ioc-19 v2.19.0 release tag).

Sources cited for MWDB Core remote proxy flaw

Showing 15 of 16 sources, primary sources first.

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 16 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats