CVE-2026-44364
CriticalSummary
In versions 3.0.7 and earlier, there is a Cross-Site Request Forgery (CSRF) vulnerability in MISP Modules that allows an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The issue was due to the home blueprint being exempted from CSRF protection.
Risk Assessment
This vulnerability could lead to modification of session query data in the context of the authenticated user, posing a risk of unauthorized access to data.
Recommendation
It is recommended to upgrade to the version of MISP Modules where CSRF protection for the affected blueprint has been enabled and query parsing has been hardened.
Other vulnerabilities in MISP Modules
See all- CVE-2026-97863Medium
The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key.
- CVE-2026-62143High
A Server-Side Request Forgery (SSRF) protection bypass was found in the html_to_markdown expansion module of misp-modules. IPv4-mapped IPv6 addresses were not normalized before blocked-range checks, allowing attacks on loopback, internal, or link-local networks.
Original NVD description (English source)
MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS