MWDB Core patches two missing-authorization flaws
CERT Polska found two missing-authorization vulnerabilities in MWDB Core letting attackers bypass API auth and capability checks, fixed in version 2.19.0.
CERT Polska disclosed two vulnerabilities in MWDB Core, a malware repository platform, discovered during its own research and coordinated through its CVD process. CVE-2026-66723 affects the Remote Instances proxy API in versions 2.2.0 through 2.18.x, where incoming requests are not authenticated, allowing an unauthenticated remote attacker to relay arbitrary requests using the identity and permissions of the configured API key. This impacts only deployments that have Remote Instances configured, but can result in unauthorized actions performed on a remote instance under another user's credentials.
CVE-2026-66724 affects deprecated config and blob upload endpoints in versions 2.0.0 through 2.18.x. These endpoints accept an undocumented POST method that bypasses capability checks enforced on the documented PUT method, allowing any authenticated user lacking adding_configs or adding_blobs capabilities to upload config and text blob objects. The impact is limited to unauthorized object creation rather than broader compromise. Both issues are fixed in MWDB Core 2.19.0, and no evidence of active exploitation is mentioned; this is a responsible disclosure advisory rather than a report of in-the-wild attacks.
Mentioned in this report
Detection guidance
MWDB Deprecated Endpoint POST Used to Bypass Upload Capability Check
Detects POST requests to MWDB's deprecated config/blob endpoints, which bypass the adding_configs/adding_blobs capability checks enforced only on the documented PUT method (CVE-2026-66724). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MWDB Deprecated Endpoint POST Used to Bypass Upload Capability Check
description: Detects HTTP POST requests against MWDB Core's deprecated config/blob
upload endpoints. These endpoints accept an undocumented POST method that bypasses
the capability checks (adding_configs/adding_blobs) enforced on the documented PUT
method, allowing unauthorized users to create objects. Generalises on method/path
mismatch rather than any single payload.
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- /config
- /blob
filter_documented_method:
cs-method: PUT
condition: selection and not filter_documented_method
falsepositives:
- Legacy automation or scripts still targeting the deprecated API version that have
not been migrated to the documented PUT endpoint
- Reverse proxies or API gateways that rewrite PUT to POST during request forwarding
level: medium
id: 19b8a4a8-fcf2-5f94-9531-37e01eff0f7b
status: experimental
author: Vorant
Unauthenticated Request to MWDB Remote Instance Proxy Endpoint
Detects requests reaching MWDB's Remote Instances proxy API path without an Authorization header, matching CVE-2026-66723 where the proxy relays requests using the stored API key's identity regardless of caller authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Request to MWDB Remote Instance Proxy Endpoint
description: Detects HTTP requests to MWDB Core's Remote Instances proxy API path
that lack an Authorization/Bearer header. In vulnerable versions (2.2.0-2.18.x)
these unauthenticated requests are still relayed to the remote instance using the
configured API key's identity, letting an attacker perform actions under another
user's credentials. Generalises on the missing-auth-header + proxy-path pattern
rather than any specific relayed action.
tags:
- attack.defense-evasion
- attack.t1078
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /remote/
filter_authenticated:
cs-authorization|startswith: 'Bearer '
condition: selection and not filter_authenticated
falsepositives:
- Web application firewalls or load balancers that strip/normalize the Authorization
header before logging, causing false positives on legitimate authenticated traffic
- Health-check or monitoring probes hitting the remote instance path without credentials
level: high
id: ad674cfe-14c5-5161-bec7-67846ddee2a8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-66723
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free