CVE-2026-95658 in MISP
Summary
by MITRE • 09/22/2026
MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allowed an attacker to craft a cross-site form post (or equivalent cross-origin request) that, when submitted by an authenticated site administrator, would cause the administrator's browser to invoke the action on the MISP instance.
The attacker could select any workflow module to execute, including action modules that write blocklist and warninglist entries, and supply arbitrary input and parameters of their choosing. This constitutes a cross-site request forgery (CSRF) vulnerability with high integrity impact on the MISP instance's security-related data.
The vulnerability was identified during an internal security review and was not externally reported. The fix is included in MISP v2.5.47.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability resides within the WorkflowsController of the Malware Information Sharing Platform, specifically affecting the moduleStatelessExecution action which was inadvertently listed in the Security component's unlockedActions configuration array. In the CakePHP framework utilized by this platform, actions included in the unlockedActions list are explicitly exempted from standard security middleware protections. This architectural decision disables two critical defense mechanisms: Cross-Site Request Forgery token verification and field hash validation. By removing these safeguards for a specific administrative endpoint, the application fails to verify that incoming requests originate from legitimate user interactions within the same context, thereby creating an opening for automated exploitation by external actors.
The core technical flaw allows any authenticated administrator's browser session to be coerced into executing arbitrary workflow modules without their explicit intent or knowledge. The moduleStatelessExecution function accepts caller-supplied input and parameters directly, passing them to the exec() method of selected workflow modules. Because CSRF protection is disabled for this endpoint, an attacker can construct a malicious web page containing a hidden form that automatically submits when visited by an administrator who has an active session with MISP. This cross-origin request triggers the execution of the specified module using parameters defined entirely by the attacker rather than through legitimate administrative interfaces.
The operational impact of this vulnerability is severe due to its high integrity implications for security-critical data within the platform. Attackers can target workflow modules responsible for writing entries to blocklists and warning lists, which are fundamental components used by MISP users to filter malicious indicators such as IP addresses, domains, or file hashes. By manipulating these inputs, an attacker could inject false positive indicators into shared threat intelligence feeds or remove legitimate protective rules. This manipulation degrades the quality of shared data across the entire community relying on this instance and can lead to operational disruptions for downstream systems that consume these blocklists, potentially allowing malicious traffic to bypass security controls or causing denial of service through incorrect filtering logic.
This issue was identified during an internal security review rather than through external reporting channels, highlighting the importance of proactive code analysis in complex web applications. The vulnerability underscores the risks associated with disabling CSRF protections for administrative endpoints that handle state-changing operations involving sensitive data structures. Mitigation requires ensuring that all actions modifying critical application state enforce strict origin verification and token validation regardless of their functional purpose. Administrators running affected versions must upgrade to MISP version 2.5.47 or later, where the moduleStatelessExecution action has been properly secured with appropriate CSRF protections restored. Until this patch is applied, organizations should restrict access to administrative interfaces through network-level controls such as IP whitelisting and multi-factor authentication to reduce the attack surface available for session hijacking or coercion attacks.
From a classification perspective, this vulnerability aligns with CWE-352 Cross-Site Request Forgery due to the lack of anti-CSRF tokens on state-changing requests. It also relates to CWE-601 URL Redirection to Untrusted Site which may be involved in crafting the malicious trigger page. In terms of adversary tactics, this exploitation vector corresponds to ATT&CK technique T1556 Cross-Site Request Forgery and potentially T1195 Supply Chain Compromise if used to poison shared threat intelligence feeds. The combination of disabled security middleware and high-privilege execution context creates a significant risk profile that necessitates immediate remediation through software updates and rigorous review of framework configuration settings for all administrative endpoints.