# CVE-2026-66723: Missing Authorization in MWDB Core Remote Instances Proxy API

> MWDB Core (CERT Polska's malware-sample/threat-intel repository, versions 2.2.0 through 2.18.x) contains a missing-authorization flaw (CWE-862, CVSS 4.0 7.0/High) in its Remote Instances proxy API: the endpoint that forwards local requests to a configured remote MWDB instance does not verify that the incoming request is authenticated, letting an unauthenticated attacker send arbitrary requests to the remote instance under the identity and permissions of the configured API key. Fixed in 2.19.0.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-07-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1821
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-mwdb-core-remote-proxy-flaw-tl-2026-1821.webp?v=b8954eda (Threadlinqs threat intel: CVE-2026-66723 MWDB Core Missing Auth: Detection & IOCs (TL-2026-1821) — High severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-1821
- **Severity:** HIGH (CVSS 7)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 30
- **CVEs:** CVE-2026-66723, CVE-2026-66724

## Description

MWDB Core is an open-source malware repository and threat-intelligence sharing platform, developed and operated by CERT Polska (also run publicly at mwdb.cert.pl), used by CSIRTs, SOC teams, and malware analysts to store samples, static/dynamic configurations, and their relationships behind a REST API.

Since milestone 2.2.0, MWDB Core has shipped an experimental 'Remote Instances' feature that lets a local deployment act as an authenticating proxy toward one or more remote MWDB deployments. An operator configures each remote in mwdb.ini under a '[remote:<name>]' section with a 'url' and an 'api_key', and lists the remote names in a 'remotes' directive. Once configured, the local instance exposes several endpoints under '/api/remote/': 'GET /api/remote/' lists configured remotes; '/api/remote/<remote_name>/<type>/<id>/pull' and '.../push' transfer individual objects (samples, configs, blobs) between local and remote; and a generic '<method> /api/remote/<remote_name>/api/<path>' endpoint forwards arbitrary API calls to the remote instance, attaching the locally configured API key so the request executes on the remote with that key's identity and permissions.

CVE-2026-66723 (CWE-862, Missing Authorization) is a flaw in this last, generic proxy endpoint: it fails to verify that the caller of '/api/remote/<remote_name>/api/<path>' is themselves an authenticated user of the local instance before forwarding the request. As a result, any unauthenticated network attacker who can reach the local MWDB instance can send arbitrary API calls through the proxy and have them executed against the remote instance with the full rights of the remote's configured API key — a classic confused-deputy / broken-access-control pattern. Because the remote API key is typically provisioned with broad rights (to pull/push malware samples and configurations), impact can include unauthorized reading of sensitive malware samples and configs, and potentially data-manipulation actions (e.g., pushing/tagging objects) on the remote repository, all attributable to the legitimate key holder rather than the true attacker.

The fix, delivered in two pull requests merged the same day the advisory was published, clarifies the exact vulnerable surface. PR #1247 ('fix/remote-api-missing-auth') added the missing authentication/authorization checks to two Flask resource classes: `RemoteAPIResource` (the generic `/api/remote/<remote_name>/api/<path>` forwarder, which had no check that the caller was an authenticated local user before proxying) and `RemotePullResource` (the `/api/remote/<remote_name>/<type>/<id>/pull` handler, which separately failed to verify the caller held the capability required to add an object of the pulled type — meaning even the 'pull' path could let an under-privileged or unauthenticated caller inject sample/config/blob objects into the local repository under types they were not entitled to create). PR #1248 ('fix/remove-legacy-post-method', commit 1d3204b) fixed the sibling CVE-2026-66724 (CWE-862, CVSS v4.0 5.3/Medium; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N; affects versions >=2.0.0, <2.19.0) by making the legacy `/api/config/<dhash>` and `/api/blob/<dhash>` endpoints return HTTP 405 for POST requests, closing an undocumented method that bypassed the `adding_configs`/`adding_blobs` capability checks enforced on the documented PUT method.

The vulnerability only affects deployments that have the Remote Instances feature configured (non-default); CERT Polska's own advisory describes the feature itself as 'undercooked and experimental' and slated for deprecation/removal in a future major release, noting that by design authenticated local users already share the same identity as the remote user associated with the API key. Both issues were fixed together in MWDB Core 2.19.0, published 2026-07-29, credited to reporter psrok1 with contributor dev-cti. No public exploitation, exploit code, or KEV listing has been observed for either CVE as of this writing; CERT Polska's advisory frames both as internally discovered, coordinated-disclosure findings rather than in-the-wild attacks.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1550 Use Alternate Authentication Material
- T1211 Exploitation for Stealth
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MWDB Core Remote Instances Proxy — Unauthenticated Confused-Deputy Request (SPL)** (`TL-2026-1821-SPL-001`)

Detects HTTP requests reaching the MWDB Core Remote Instances generic proxy endpoint (/api/remote/<remote_name>/api/<path>, the RemoteAPIResource Flask class) that carry no Authorization header yet still receive a successful (2xx) response — the exact signature of CVE-2026-66723 (CWE-862): RemoteAPIResource forwards the call to the remote instance using the locally-configured API key without first checking that the caller is an authenticated local user.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1199, T1550.001
- **Data sources:** mwdb_core_application_access_log, reverse_proxy_access_log
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype="mwdb:proxy:access" earliest=-24h
| regex uri_path="\/api\/remote\/[^\/]+\/api\/.*"
| eval auth_present=if(isnotnull(authorization_header) AND len(authorization_header)>0,1,0)
| where auth_present=0 AND status>=200 AND status<300
| stats count as hit_count, min(_time) as first_seen, max(_time) as last_seen, values(uri_path) as paths, values(remote_name) as remotes by src_ip
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| where hit_count>=1
| table src_ip, remotes, paths, hit_count, first_seen, last_seen
| sort -hit_count
```

### Microsoft KQL

```kql
MWDBCoreAccessLog_CL
| where TimeGenerated > ago(24h)
| where RequestPath_s matches regex @"/api/remote/[^/]+/api/.*"
| where isempty(AuthorizationHeaderPresent_b) or AuthorizationHeaderPresent_b == false
| where ResponseStatusCode_d >= 200 and ResponseStatusCode_d < 300
| summarize HitCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Paths = make_set(RequestPath_s), Remotes = make_set(RemoteInstanceName_s) by ClientIP_s
| where HitCount >= 1
| project ClientIP_s, Remotes, Paths, HitCount, FirstSeen, LastSeen
| order by HitCount desc
```

### Sigma

```yaml
title: MWDB Core Remote Instances Proxy Called Without Authorization Header
id: 6f2a9c3e-1b7d-4e5a-9c8f-1821000000a1
status: experimental
description: Detects HTTP requests reaching the MWDB Core Remote Instances generic proxy endpoint (/api/remote/<remote_name>/api/<path>, RemoteAPIResource) with no Authorization header that still receive a 2xx response, consistent with CVE-2026-66723 (CWE-862) confused-deputy exploitation.
references:
    - https://cert.pl/en/posts/2026/07/CVE-2026-66723/
    - https://github.com/CERT-Polska/mwdb-core/security/advisories/GHSA-942c-r7qj-w895
    - https://github.com/CERT-Polska/mwdb-core/pull/1247
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-02
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1199
    - attack.defense-evasion
    - attack.t1550.001
    - cve.2026.66723
logsource:
    category: webserver
    product: mwdb-core
detection:
    selection_path:
        cs-uri-stem|contains: '/api/remote/'
        cs-uri-stem|re: '.*/api/remote/[^/]+/api/.*'
    selection_status:
        sc-status|startswith: '2'
    filter_authorized:
        cs-Authorization|exists: true
    condition: selection_path and selection_status and not filter_authorized
falsepositives:
    - Reverse proxy or load balancer misconfiguration stripping the Authorization header before requests reach MWDB Core
    - Monitoring/health-check probes hitting unrelated /api/remote/ list endpoints without credentials by design
level: high
```

**Known false positives:**

- A misconfigured reverse proxy or load balancer strips the Authorization header before it reaches MWDB Core, making legitimate authenticated calls appear header-less
- Health-check or monitoring probes hitting unrelated /api/remote/ list endpoints without credentials by design

**Tuning notes:** Baseline the expected remote_name values from mwdb.ini and alert only on unexpected remote/path combinations; verify with a known-good authenticated call that the reverse proxy is not stripping Authorization headers before treating hits as true positives; exclude known health-check source IPs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MWDB Core Remote Instances Proxy — Unauthenticated Confused-Deputy Request (KQL) (locked: unlock with TL Creds)
- MWDB Core Remote Pull / Legacy Upload Capability Bypass (KQL) (locked: unlock with TL Creds)
- MWDB Core Confused-Deputy Egress — Unauthenticated Inbound Triggers Authenticated Outbound to Remote Instance (KQL) (locked: unlock with TL Creds)
- MWDB Core Remote Instances Proxy — Unauthenticated Confused-Deputy Request (Sigma) (locked: unlock with TL Creds)
- MWDB Core Remote Pull / Legacy Upload Capability Bypass (Sigma) (locked: unlock with TL Creds)
- MWDB Core Confused-Deputy Egress — Unauthenticated Inbound Triggers Authenticated Outbound to Remote Instance (Sigma) (locked: unlock with TL Creds)
- MWDB Core Remote Pull / Legacy Upload Capability Bypass (SPL) (locked: unlock with TL Creds)
- MWDB Core Confused-Deputy Egress — Unauthenticated Inbound Triggers Authenticated Outbound to Remote Instance (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Vulnerabilities in MWDB Core software | CERT Polska](https://cert.pl/en/posts/2026/07/CVE-2026-66723/)
- [CVE-2026-66723 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-66723)
- [CVE-2026-66724 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-66724)
- [GHSA-942c-r7qj-w895: Missing authentication requirement in Remote Instances proxy API](https://github.com/CERT-Polska/mwdb-core/security/advisories/GHSA-942c-r7qj-w895)
- [GHSA-8fv8-wffg-4323: Undocumented HTTP method on deprecated config/blob upload endpoints allow bypassing permissions (CVE-2026-66724)](https://github.com/CERT-Polska/mwdb-core/security/advisories/GHSA-8fv8-wffg-4323)
- [PR #1247: fix/remote-api-missing-auth — add authorization to RemoteAPIResource / RemotePullResource](https://github.com/CERT-Polska/mwdb-core/pull/1247)
- [PR #1248: fix/remove-legacy-post-method — remove undocumented POST on legacy config/blob endpoints](https://github.com/CERT-Polska/mwdb-core/pull/1248)
- [CERT-Polska/mwdb-core (repository)](https://github.com/CERT-Polska/mwdb-core)
- [mwdb-core releases](https://github.com/CERT-Polska/mwdb-core/releases)
- [mwdb-core remotes-guide.rst](https://github.com/CERT-Polska/mwdb-core/blob/master/docs/remotes-guide.rst)
- [Remote instances guide — mwdb-core documentation](https://mwdb.readthedocs.io/en/latest/remotes-guide.html)
- [mwdb-core README](https://github.com/CERT-Polska/mwdb-core/blob/master/README.md)
- [Remote API feature - synchronization with other instances (Issue #157)](https://github.com/CERT-Polska/mwdb-core/issues/157)
- [CWE-862: Missing Authorization — MITRE CWE definition](https://cwe.mitre.org/data/definitions/862.html)
- [CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-66723/66724 not listed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1821