Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.4
CVE-2026-86419: MISP can leak credentials and access internal servers
CVE-2026-86419 · published 1 month ago
Summary
Versions of MISP up to 2.5.45 may follow web redirects without checking where they go, sending stored feed passwords or API keys to unintended sites and even reaching internal network machines. The same weakness also affects the TAXII discovery feature, which can be tricked into contacting internal addresses. Update MISP to the latest release or apply the provided patches to stop unsafe redirects and block internal‑only requests.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| misp-project | misp |
<= 2.5.45 cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:* |
| misp | misp | <= 2.5.45 |
Original advisory text
MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.
In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation.
The TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.
Together, these commits harden MISP's outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding.
Version affected: ≤2.5.45
In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation.
The TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.
Together, these commits harden MISP's outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding.
Version affected: ≤2.5.45
References
- https://github.com/MISP/MISP/commit/06f541dcf Patch
- https://github.com/MISP/MISP/commit/08d6efe24 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86419... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-86419 Vendor Advisory
- https://github.com/MISP/MISP Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.4
High
Type
CWE-918Server-Side Request Forgery (SSRF)
CWE-200Information Exposure
Timeline
Published7 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Track software like this
Free during beta