CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

cve-search unauthenticated /fetch_cve_data parameter manipulation exposes admin credential hashes

cve · CVE-2026-59509

Coverage
1
first 2026-07-05 → last 2026-07-05
Latest activity
2026-07-05
cve-search patches a pre-auth flaw that reads admin credential hashes via /fetch_cve_data
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, technology · regions: europe
Sources cited
2
2 hosts

Action items (3)

Do-now tasks recorded on the entries about CVE-2026-59509, newest first. Check the date before acting on an older one.

  • Inventory cve-search deployments and upgrade to v6.0.1 or later; the fix allowlists the retrieve/column parameters and enforces pagination bounds on /fetch_cve_data.
    2026-07-05CVE-2026-59509
  • Until upgraded, confirm the cve-search web/API component is not reachable from untrusted networks (reverse-proxy / firewall ACLs on the Flask listener) and, if internet-facing, treat exposure as urgent.
    2026-07-05CVE-2026-59509
  • If /fetch_cve_data may have been reached with non-default collection/column/regex parameters, rotate all cve-search admin credentials, mgmt_users hashes exposed to read enable offline cracking.
    2026-07-05CVE-2026-59509

Defender insights

What each entry about CVE-2026-59509 tells a defender to do, newest first.

2026-07-05NOTABLEcve-search patches a pre-auth flaw that reads admin credential hashes via /fetch_cve_data

Story timeline

  1. 2026-07-05CVE-2026-59509, cve-search: unauthenticated /fetch_cve_data parameter manipulation exposes admin credential hashes (CVSS 9.2)
    trending-vulnerabilitiescve-search patches a pre-auth flaw that reads admin credential hashes via /fetch_cve_data

Hunting pivots

Tags
info-disclosurepatch-availablepre-authsqlivulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Credential AccessUnsecured Credentials

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-05/cve-2026-59509-cve-search-fetch-cve-data-nosql · ATT&CK page ↗

Credential Access TA0006

T1552Unsecured Credentials×1

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Evidence: 2026-07-05/cve-2026-59509-cve-search-fetch-cve-data-nosql · ATT&CK page ↗

Entries about cve-search unauthenticated /fetch_cve_data parameter manipulation exposes admin credential hashes (1)

2026-07-05 · view entry permalink →

NOTABLECVE-2026-59509

CVE-2026-59509, cve-search: unauthenticated /fetch_cve_data parameter manipulation exposes admin credential hashes (CVSS 9.2)

CVE-2026-59509 is an unauthenticated improper-input-validation flaw (CWE-20, CVSS 4.0 9.2, vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) in the POST /fetch_cve_data endpoint of cve-search, the open-source CVE/CPE aggregation and search tool maintained by CIRCL (Luxembourg's CSIRT) and widely run internally by European CERTs, CSIRTs and MISP-adjacent CTI teams. The handler trusted attacker-controlled request parameters to select the target MongoDB collection, the projected fields, and the regex filters rather than restricting queries to the CVE collection, so a remote unauthenticated caller could redirect the query to arbitrary application collections (including mgmt_users) and read administrative usernames and password hashes, enabling offline cracking and admin-account takeover of the instance (CIRCL/NVD, 2026-07-05). Versions v4.0 through v6.0.0 are affected; the project's own fix (fix(web): add server-side validations for /fetch_cve_data inputs) was merged 2026-06-22 and shipped in v6.0.1, adding a CVE-only collection restriction, an allowlist for DataTables column fields, and enforced pagination bounds, all invalid requests now return HTTP 400 (cve-search project, GitHub PR #1218). No in-the-wild exploitation has been reported by either source and EPSS is not yet published, consistent with a same-day CVE assignment on an already-merged fix.

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.

ThreatInt.eu (CVE aggregator) 2026-07-05

fix(web): add server-side validations for /fetch_cve_data inputs

cve-search project (GitHub PR #1218, fix) 2026-06-22
vulnerability05 Jul 18:16Zmulti-sourceOpen finding →
Sources: cve-search project (GitHub PR #1218, fix) · ThreatInt.eu (CVE aggregator)

explore in graph

Where this entity is cited

  • Vulns1

Source distribution

  • cve.threatint.eu1 (50%)
  • github.com1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)