CVE-2026-59509 — cve-search: unauthenticated /fetch_cve_data parameter manipulation exposes admin credential hashes (CVSS 9.2)
CVE-2026-59509 is an unauthenticated improper-input-validation flaw (CWE-20, CVSS 4.0 9.2, vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) in the POST /fetch_cve_data endpoint of cve-search, the open-source CVE/CPE aggregation and search tool maintained by CIRCL (Luxembourg's CSIRT) and widely run internally by European CERTs, CSIRTs and MISP-adjacent CTI teams. The handler trusted attacker-controlled request parameters to select the target MongoDB collection, the projected fields, and the regex filters rather than restricting queries to the CVE collection, so a remote unauthenticated caller could redirect the query to arbitrary application collections — including mgmt_users — and read administrative usernames and password hashes, enabling offline cracking and admin-account takeover of the instance (CIRCL/NVD, 2026-07-05). Versions v4.0 through v6.0.0 are affected; the project's own fix (fix(web): add server-side validations for /fetch_cve_data inputs) was merged 2026-06-22 and shipped in v6.0.1, adding a CVE-only collection restriction, an allowlist for DataTables column fields, and enforced pagination bounds — all invalid requests now return HTTP 400 (cve-search project, GitHub PR #1218). No in-the-wild exploitation has been reported by either source and EPSS is not yet published, consistent with a same-day CVE assignment on an already-merged fix.
An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.
fix(web): add server-side validations for /fetch_cve_data inputs
Defender actions
- Inventory cve-search deployments and upgrade to v6.0.1 or later; the fix allowlists the retrieve/column parameters and enforces pagination bounds on /fetch_cve_data.
- Until upgraded, confirm the cve-search web/API component is not reachable from untrusted networks (reverse-proxy / firewall ACLs on the Flask listener) and, if internet-facing, treat exposure as urgent.
- If /fetch_cve_data may have been reached with non-default collection/column/regex parameters, rotate all cve-search admin credentials — mgmt_users hashes exposed to read enable offline cracking.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Credential Access TA0006
T1552Unsecured Credentials
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.