CVE-2026-67178 in MISP
Summary
by MITRE • 07/28/2026
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect:
Redirect permanent / https://misp.example
Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configured destination URL. Because the destination did not end with /, attacker-controlled path content was appended directly to the hostname rather than to its URL path.
For example, a request resembling:
http://misp.example/@attacker.example/
could result in a redirect resembling:
https://[email protected]/
Under standard URL parsing, misp.example is interpreted as user information and attacker.example as the destination host. An unauthenticated remote attacker could therefore construct a URL hosted under the legitimate MISP domain that redirects users to an attacker-controlled website.
The vulnerability could be used for phishing, credential collection, or potentially disclosing sensitive query-string information preserved during the redirect. Exploitation requires a user to follow the crafted HTTP URL.
The fix adds the missing trailing slash to the redirect destination, ensuring that appended request data remains part of the path on the configured MISP host.
Existing installationsExisting MISP installations should review their Apache HTTP virtual-host configuration and ensure that the HTTPS redirect destination ends with a trailing slash:
Redirect permanent / https://misp.example/
After updating the configuration, validate it with apachectl configtest and reload or restart Apache for the change to take effect
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability resides within the MISP installation process where automated scripts generate Apache HTTP server virtual-host configurations containing malformed redirect directives. The flaw specifically manifests in how the Redirect permanent directive handles URL path appending when the destination lacks a trailing slash character. According to cw 654, this represents a classic improper input validation issue where the system fails to properly sanitize or format redirection targets, creating an opportunity for manipulation of URL parsing behavior.
The technical implementation of this vulnerability stems from Apache's handling of redirect directives where the absence of a trailing slash in the destination URL causes the server to treat subsequent path components as part of the host specification rather than path elements. This behavior creates a parsing ambiguity that attackers can exploit through carefully crafted URLs containing atypical characters such as the @ symbol. The redirect directive in question takes the form Redirect permanent / https://misp.example which fails to properly terminate the hostname component, allowing attacker-controlled path data to be interpreted as part of the destination host.
From an operational perspective, this vulnerability creates a significant security risk that aligns with attack techniques described in the mitre att&ck framework under initial access and credential access phases. The vulnerability enables attackers to construct URLs that appear legitimate within the context of the MISP domain while redirecting users to malicious third-party domains. This phishing capability represents a sophisticated social engineering vector where users are misled by the authentic-looking URL structure, potentially exposing them to credential harvesting or other malicious activities. The vulnerability specifically affects unauthenticated remote attackers who can craft malicious URLs without requiring any authentication credentials.
The impact extends beyond simple redirection since sensitive query string parameters may be preserved during the redirect process, potentially exposing confidential information. According to security best practices outlined in various industry standards, this type of vulnerability demonstrates poor input sanitization and configuration management practices that compromise the integrity of web application redirects. The vulnerability could be leveraged for several attack vectors including credential theft through phishing, data exfiltration via query parameter exposure, or further exploitation if users are directed to malicious sites capable of executing additional attacks.
The remediation strategy directly addresses the root cause by ensuring proper URL formatting in the Apache configuration through the addition of a trailing slash to the redirect destination. This simple but critical change forces the server to treat all appended path data as part of the destination path rather than attempting to parse it as host information. Security practitioners should validate that existing installations maintain this configuration and verify that all virtual-host configurations properly terminate redirect destinations with appropriate path separators. The fix aligns with configuration management best practices by ensuring proper implementation of web server security controls and preventing similar issues in future deployments.
Organizations maintaining MISP installations must perform immediate review of their Apache HTTP server configurations to ensure that all redirect directives properly terminate with trailing slashes when redirecting to HTTPS endpoints. The validation process should include running apachectl configtest to verify configuration syntax and proper reloading of Apache services to activate the changes. This remediation approach addresses the specific vulnerability while maintaining the intended functionality of redirecting users from HTTP to HTTPS protocols without compromising security or user experience.