Skip to content
OpenAdvisories
Medium WID-SEC-2026-4036 7 CVEs

MISP und MISP Modules: Mehrere Schwachstellen

Published Oct 19, 2026 · Updated Oct 19, 2026 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

MISP ist eine Open-Source-Plattform für den Informationsaustausch über Bedrohungen.

Vulnerabilities 7

  • High 7.1
    CVE-2026-112178

    MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control

    MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organi…

    MISP MISP
  • High 7.1
    CVE-2026-112188

    MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

    MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the confi…

    MISP MISP
  • Medium 6.3
    CVE-2026-112991

    MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()

    The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting severa…

    MISP misp-modules
  • Medium 5.3
    CVE-2026-112192

    MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings

    MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata. As a result: - A…

    MISP MISP
  • Medium 5.1
    CVE-2026-112180

    MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records

    MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph ent…

    MISP MISP
  • Medium 4.8
    CVE-2026-112183

    MISP CSS Injection via Remote Tag Colour in Event Preview

    MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficien…

    MISP MISP
  • Medium 4.8
    CVE-2026-112184

    MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels

    MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who…

    MISP MISP

Revision history

  1. #1

    Initiale Fassung

References