MWDB Core patches two missing-authorization flaws
CERT Polska found two missing-authorization vulnerabilities in MWDB Core letting attackers bypass API auth and capability checks, fixed in version 2.19.0.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed two vulnerabilities in MWDB Core, a malware repository platform, discovered during its own research and coordinated through its CVD process. CVE-2026-66723 affects the Remote Instances proxy API in versions 2.2.0 through 2.18.x, where incoming requests are not authenticated, allowing an unauthenticated remote attacker to relay arbitrary requests using the identity and permissions of the configured API key. This impacts only deployments that have Remote Instances configured, but can result in unauthorized actions performed on a remote instance under another user's credentials.
CVE-2026-66724 affects deprecated config and blob upload endpoints in versions 2.0.0 through 2.18.x. These endpoints accept an undocumented POST method that bypasses capability checks enforced on the documented PUT method, allowing any authenticated user lacking adding_configs or adding_blobs capabilities to upload config and text blob objects. The impact is limited to unauthorized object creation rather than broader compromise. Both issues are fixed in MWDB Core 2.19.0, and no evidence of active exploitation is mentioned; this is a responsible disclosure advisory rather than a report of in-the-wild attacks.
Mentioned in this report
Detection guidance
MWDB Deprecated Endpoint POST Used to Bypass Upload Capability Check
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects POST requests to MWDB's deprecated config/blob endpoints, which bypass the adding_configs/adding_blobs capability checks enforced only on the documented PUT method (CVE-2026-66724). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MWDB Deprecated Endpoint POST Used to Bypass Upload Capability Check
description: Detects HTTP POST requests against MWDB Core's deprecated config/blob
upload endpoints. These endpoints accept an undocumented POST method that bypasses
the capability checks (adding_configs/adding_blobs) enforced on the documented PUT
method, allowing unauthorized users to create objects. Generalises on method/path
mismatch rather than any single payload.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- /config
- /blob
filter_documented_method:
cs-method: PUT
condition: selection and not filter_documented_method
falsepositives:
- Legacy automation or scripts still targeting the deprecated API version that have
not been migrated to the documented PUT endpoint
- Reverse proxies or API gateways that rewrite PUT to POST during request forwarding
level: medium
id: 19b8a4a8-fcf2-5f94-9531-37e01eff0f7b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-66723
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs