An information disclosure vulnerability exists in the MISP Modules website component's external tools management interface. The /external_tools/list endpoint returns stored API keys in its JSON response without requiring authentication, exposing these keys to any network-reachable client. Additionally, the browser-based edit form pre-populates the API key field with the stored credential, exposing it in the DOM and client memory. This vulnerability allows attackers to obtain API keys used for authenticating submissions to external analysis or enrichment services, potentially enabling impersonation of the MISP instance or unauthorized access to external services. The impact is limited to confidentiality; no integrity or availability issues are indicated.