CVE-2026-85239 in MISP
Summary
by MITRE • 09/03/2026
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field.
The EventTemplate::beforeValidate() method only performed semantic validation when the supplied definition was already represented as an array. If a caller instead supplied a pre-encoded string, including malformed JSON or JSON representing an unexpected data type, the value bypassed validateDefinition() and only needed to satisfy the generic notBlank validation rule. As a result, an invalid event template definition could be stored persistently in the database.
When event templates were subsequently retrieved, EventTemplate::afterFind() attempted to decode the stored definition using JsonTool::decode() without handling decoding failures. A definition containing invalid JSON could therefore trigger an exception during retrieval. Because the event template index is available to all authenticated users, a single malicious or malformed template could make the event template listing and other functionality relying on EventTemplate queries return HTTP 500 errors until the offending database row was manually repaired.
Valid JSON representing an unexpected type, rather than the expected JSON object, could similarly result in invalid data reaching downstream consumers.
The vulnerability can therefore be exploited by a user capable of saving event templates to persist malformed template data and cause a persistent denial of service against event-template functionality for other users.
The patch enforces that event template definitions must be supplied as structured objects before saving and always applies semantic validation. On retrieval, malformed JSON and definitions that do not decode to the expected structure are caught, logged, and replaced with an empty definition, preventing a malformed database entry from breaking all event template queries.
Poisoning doesn't seem reachable according to the lead developer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in MISP relates to improper input validation within the EventTemplate module, specifically affecting how event templates are created and retrieved by authenticated users with appropriate permissions. The core technical flaw resides in the EventTemplate::beforeValidate() method, which is responsible for ensuring data integrity before persistence. This method was designed to perform semantic validation only when the supplied definition field was already structured as an array. However, if a caller provided a pre-encoded string representation of JSON, including malformed JSON or valid JSON representing unexpected data types such as strings or numbers instead of objects, the system bypassed the critical validateDefinition() logic. Consequently, these invalid entries were accepted by the generic notBlank validation rule and stored persistently in the database without triggering an error at the point of entry. This behavior represents a classic case of CWE-20 Improper Input Validation, where the application fails to adequately sanitize or verify user-supplied input before processing it.
The operational impact of this flaw becomes apparent during data retrieval operations. When event templates are fetched from the database, the EventTemplate::afterFind() method attempts to decode the stored definition using JsonTool::decode(). This decoding process does not include error handling for malformed JSON structures. As a result, if an attacker or a user inadvertently saves a template with invalid JSON syntax, any subsequent attempt to retrieve that specific record triggers an unhandled exception. Because the event template index is accessible to all authenticated users in many configurations, this single point of failure can cascade into a persistent denial of service condition. The entire event template listing page and other functionalities relying on EventTemplate queries may return HTTP 500 Internal Server Error responses until the offending database row is manually corrected by an administrator. This aligns with CWE-754 Improper Check for Unusual or Exceptional Conditions, as the application fails to handle exceptional input states gracefully during read operations.
Beyond simple denial of service, there are implications related to data integrity and downstream consumption. If valid JSON representing an unexpected type is stored rather than malformed syntax, it may not crash the retrieval process but can still result in invalid data reaching downstream consumers or integrations that expect a specific object structure. This could lead to unpredictable behavior in connected systems or visualizations within MISP that rely on consistent template structures. The vulnerability effectively allows authenticated users with write access to event templates to poison the application's state, degrading service availability and potentially compromising the reliability of threat intelligence sharing workflows. Although some assessments suggest that poisoning scenarios may not be directly reachable for exploitation beyond denial of service due to specific architectural constraints noted by developers, the risk remains significant for operational stability.
The remediation strategy implemented in the patch addresses these issues through rigorous enforcement at both write and read boundaries. On the input side, event template definitions are now enforced to be supplied as structured objects before saving, ensuring that semantic validation is always applied regardless of how the data was initially formatted by the client. This closes the gap where string-based inputs previously bypassed checks. Furthermore, on the output side, malformed JSON and definitions that do not decode into the expected structure are caught during retrieval. Instead of throwing an exception that crashes the application, these cases are logged for administrative review and replaced with an empty definition. This defensive programming approach ensures that a single corrupted database entry does not break all event template queries, thereby maintaining service availability even in the presence of bad data.
From a threat modeling perspective, this vulnerability can be mapped to ATT&CK techniques related to persistence or disruption within enterprise environments. While it is primarily an internal authenticated user issue rather than an external remote code execution vector, its ability to disrupt critical intelligence sharing platforms makes it a high-impact flaw for organizations relying on MISP for collaborative cyber threat analysis. Security teams should ensure that all instances of MISP are updated to the patched version immediately. Additionally, administrators should audit existing event templates for any malformed definitions that may have been introduced prior to patching and manually correct them if necessary to restore full functionality without reliance on automatic fallbacks during retrieval operations.