Skip to content
OpenAdvisories
Medium WID-SEC-2026-1631 3 CVEs

MISP: Mehrere Schwachstellen

Published May 20, 2026 · Updated May 20, 2026 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren, und um einen Denial of Service Angriff durchzuführen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 3

  • High 8.3
    CVE-2026-9136

    Unauthorized ShadowAttribute modification in MISP via client-supplied identifier

    A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied p…

    MISP MISP
  • Medium 6.0
    CVE-2026-9084

    MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations

    MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is …

    MISP MISP
  • Medium 5.1
    CVE-2026-9137

    CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit

    The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB before truncation. On deployments where the endpoint is reachable by untrusted clients, this could allow attackers to generate excessive lo…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References