CVE-2026-44363 affects MISP misp-modules before version 3.0.7. The vulnerability involves improper certificate validation (CWE-295) and unsafe remote resource fetching (CWE-918). The html_to_markdown module accepted arbitrary URLs without adequate validation, enabling SSRF attacks against internal network resources. The qrcode module disabled TLS certificate verification, allowing potential man-in-the-middle interception or response tampering. The fix in version 3.0.7 includes validating URL schemes, blocking local and private IP ranges, resolving hostnames prior to fetching, enforcing request timeouts, and re-enabling TLS certificate verification to secure remote requests.

Exploitation of this vulnerability could allow an attacker to perform SSRF attacks targeting internal or private network resources via the html_to_markdown module. Additionally, disabling TLS certificate verification in the qrcode module could expose communications to man-in-the-middle attacks, potentially leading to interception or tampering of data fetched remotely. The CVSS 4.0 score is 5.8 (medium severity), reflecting these risks. No known exploits are reported in the wild at this time.

Upgrade MISP misp-modules to version 3.0.7 or later, where the vulnerabilities have been fixed. The fix includes proper URL validation, blocking of local/private address ranges, hostname resolution before fetching, request timeouts, and re-enabling TLS certificate verification. Since the vendor advisory indicates the issue is fixed in 3.0.7, applying this update is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.