CVE-2026-86419
Received Received - Intake

Server-Side Request Forgery in MISP Feed Processing

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: CIRCL

Description
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation. The TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator. Together, these commits harden MISP's outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86419
EUVD
EUVD-2026-72370

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.45 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86419 affects MISP versions 2.5.45 and earlier. It involves insufficient validation of outbound HTTP destinations during feed retrieval and TAXII discovery. Redirects were followed without checking the destination or scheme, causing authentication headers to be reused and potentially leaked to unauthorized hosts. This could lead to Server-Side Request Forgery (SSRF) attacks, including access to internal network resources.

Detection Guidance

I don't know

Check MISP version with 'misp --version' or via the web interface. If version is ≤2.5.45, the system is vulnerable. Review feed and TAXII configuration for improper redirect handling or SSRF risks.

Impact Analysis

An attacker could exploit this to access internal systems by tricking MISP into making requests to restricted hosts. Credentials configured for feeds might be sent to unintended destinations, risking unauthorized access. The vulnerability also allows bypassing SSRF defenses through alternate address representations like IPv6 loopback or numeric encodings.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or access, violating GDPR's data protection principles or HIPAA's security requirements. Credential leaks or internal host access may result in compliance breaches, fines, or legal consequences depending on the data involved.

Mitigation Strategies

Upgrade MISP to version >2.5.45 immediately. Disable or audit feed configurations for unsafe redirects. Review TAXII discovery settings to ensure proper URL validation is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86419. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart