Maltego incorrectly shares a MISP connection across users in a remote-transform use case

CRITICAL 9.8CVE-2020-12889 · GHSA-fj35-m94r-9h4c · PYSEC-2020-66 · Published 15/05/2020 · updated 17/06/2026

In short

CVE-2020-12889 is a CRITICAL (CVSS 9.8) vulnerability affecting misp-maltego, misp-maltego (misp).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 69.1% of all vulnerabilities.
Fix: update to 1.4.5 or later.

Package	Affected versions	Patched versions
misp-maltego PyPI	`< 1.4.5`	`1.4.5`
misp-maltego misp	`= 1.4.4`	No fix yet

MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. Version 1.4.5 contains a patch.

NVD description

MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.