CVE-2026-86419 in MISP
Summary
by MITRE • 09/07/2026
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.
In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation.
The TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.
Together, these commits harden MISP's outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding.
Version affected: ≤2.5.45
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/07/2026
Versions of the Malware Information Sharing Platform up to 2.5.45 contain critical flaws in server-side outbound HTTP destination validation within feed retrieval and TAXII discovery functionalities. These vulnerabilities stem from insufficient checks on redirect behavior, DNS resolution handling, and credential management during external network requests. The primary issue involves the automatic following of HTTP redirects without validating either the scheme or the final destination host. This lack of strict enforcement allows an attacker to manipulate a trusted feed source into initiating connections to arbitrary targets, including internal network resources that are normally inaccessible from the public internet.
In the context of feed processing, when MISP follows a redirect chain, it reuses the original request headers across all hops. Consequently, authentication tokens or API credentials configured for a specific external feed can be inadvertently forwarded to an untrusted third-party host if a malicious redirect is encountered. This behavior constitutes a form of cross-host credential leakage, where sensitive security data intended for one service provider is exposed to another entity that may have no legitimate business relationship with the organization operating MISP. Additionally, because internal IP addresses and private network ranges are not blocked during these redirects, an attacker can exploit this mechanism to perform Server-Side Request Forgery attacks against local infrastructure services such as database servers, administrative panels, or other microservices residing within the same network segment.
The TAXII discovery endpoint exhibited a related but distinct vulnerability characterized by incomplete SSRF defenses. The implementation relied on gethostbyname() for DNS resolution and performed validation checks against only a limited set of literal addresses. This approach failed to account for various alternate address representations that could bypass these simplistic checks. Specifically, the logic did not properly handle IPv6 loopback addresses such as ::1 or numeric host encodings like 0x7f000001, which resolve to localhost but were not explicitly blocked by the existing validation rules. Furthermore, the system did adequately account for scenarios involving multiple DNS records pointing to different destinations, allowing an attacker to potentially bypass filters by leveraging DNS round-robin or other resolution variations that result in internal IP addresses being reached despite initial external-looking domain names.
These flaws collectively expose organizations running affected versions of MISP to significant risks including unauthorized access to internal systems, data exfiltration via credential leakage, and potential lateral movement within the network perimeter if SSRF is successfully exploited against vulnerable internal services. The vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) due to the ability to force the server into making requests to unintended destinations. It also relates to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor regarding the forwarding of authentication headers, and CWE-447 Unverified Use of Dangerous Constructs concerning the unsafe handling of DNS resolution and redirect chains without proper verification.
The remediation strategy implemented in subsequent versions addresses these issues by hardening outbound URL handling through several key mechanisms. First, strict validation is now applied to all redirects, ensuring that both the scheme and destination are verified before proceeding. Second, internal network destinations are explicitly blocked for cross-host redirects to prevent SSRF attacks targeting local infrastructure. Third, configured feed credentials are stripped from request headers before following any redirect to a different host, thereby eliminating the risk of credential leakage to unauthorized parties. Finally, DNS results are pinned after validation to prevent re-resolution attacks where an attacker might alter DNS records between the initial check and the actual connection attempt, ensuring that the resolved IP address remains consistent with the validated target.
For TAXII discovery specifically, the fix migrates this functionality to a shared URL egress validator module. This centralization ensures uniform application of security controls across all outbound HTTP operations within MISP rather than relying on disparate, potentially flawed validation logic in individual endpoints. By adopting a centralized approach, the platform mitigates risks associated with alternate-address representations and DNS-related bypasses more effectively. Organizations utilizing versions up to 2.5.45 should upgrade immediately to mitigate these risks. In addition to upgrading, administrators should review network segmentation policies and ensure that any remaining outbound HTTP traffic from MISP instances is monitored for anomalies indicative of SSRF attempts or unauthorized credential forwarding activities as part of a defense-in-depth strategy aligned with MITRE ATT&CK techniques such as T1560.