CVE-2026-67178
Received Received - Intake

Open Redirect in MISP via Apache HTTP Virtual-Host Configuration

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configured destination URL. Because the destination did not end with /, attacker-controlled path content was appended directly to the hostname rather than to its URL path. For example, a request resembling: http://misp.example/@attacker.example/ could result in a redirect resembling: https://[email protected]/ Under standard URL parsing, misp.example is interpreted as user information and attacker.example as the destination host. An unauthenticated remote attacker could therefore construct a URL hosted under the legitimate MISP domain that redirects users to an attacker-controlled website. The vulnerability could be used for phishing, credential collection, or potentially disclosing sensitive query-string information preserved during the redirect. Exploitation requires a user to follow the crafted HTTP URL. The fix adds the missing trailing slash to the redirect destination, ensuring that appended request data remains part of the path on the configured MISP host. Existing installationsExisting MISP installations should review their Apache HTTP virtual-host configuration and ensure that the HTTPS redirect destination ends with a trailing slash: Redirect permanent / https://misp.example/ After updating the configuration, validate it with apachectl configtest and reload or restart Apache for the change to take effect

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-67178
EUVD
EUVD-2026-49856

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 15becd3b21245ddc6a8b5dad46e983ade405ddf8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an incorrectly formatted HTTP-to-HTTPS redirect in MISP installation scripts. The redirect lacked a trailing slash, causing Apache to append path content directly to the hostname. For example, a crafted URL like http://misp.example/@attacker.example/ could redirect to https://[email protected]/, tricking users into visiting an attacker-controlled site. This enables phishing, credential theft, or exposure of sensitive query strings.

Detection Guidance

Check Apache virtual-host configuration files for incorrect HTTP-to-HTTPS redirects. Look for lines like 'Redirect permanent / https://misp.example' without a trailing slash. Use commands like 'grep -r "Redirect permanent" /etc/apache2/sites-enabled/' or 'apachectl -S' to inspect configurations.

Impact Analysis

If you use MISP with an unpatched Apache configuration, clicking a malicious link could redirect you to a fake website mimicking MISP. This may lead to stolen login credentials, phishing attacks, or exposure of sensitive data in URLs. Users must follow crafted links for exploitation, so vigilance in link sources is critical.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by enabling phishing attacks that steal credentials or sensitive data. Unauthorized redirects may expose personal or health information during the redirect process, potentially leading to data breaches and compliance violations. Organizations must patch to mitigate risks.

Mitigation Strategies

Update the Apache virtual-host configuration to add a trailing slash to the HTTPS redirect destination. Change 'Redirect permanent / https://misp.example' to 'Redirect permanent / https://misp.example/'. Validate with 'apachectl configtest' and reload Apache with 'systemctl reload apache2' or 'service apache2 reload'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67178. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart