CVE-2026-67178
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The MISP Apache HTTP virtual-host configuration contains a malformed HTTP-to-HTTPS redirect missing a trailing slash in the destination URL. An attacker can exploit this to redirect users to a malicious site via a crafted HTTP request.
Risk Assessment
The risk includes phishing attacks, credential harvesting, and potential disclosure of sensitive query-string data during the redirect.
Recommendation
Review the Apache virtual-host configuration, add a trailing slash to the Redirect permanent directive, validate with apachectl configtest, and reload or restart Apache.
Other vulnerabilities in MISP
See all- CVE-2026-61474Medium
An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.
- CVE-2017-14337High
In MISP versions before 2.4.80, when configured with X.509 certificate authentication alongside a non-MISP external user management API, an unauthenticated user can gain access as an arbitrary user if the API returns an empty value.
- CVE-2026-10868Critical
MISP has a mass assignment vulnerability in the user edit functionality (UsersController::edit()). An authenticated attacker can modify the user ID in the request, leading to updates on another user's account.
- CVE-2026-10611Critical
MISP contains an authentication bypass vulnerability when LDAP mixed authentication is enabled with OTP enforcement. An authenticated user can bypass the OTP step and access the application without providing a TOTP, HOTP, or email OTP code.
- CVE-2024-29859Critical
In MISP before version 2.4.187, the add_misp_export function in app/Controller/EventsController.php does not properly check for a valid file upload.
- CVE-2024-25674Critical
An issue was discovered in MISP before version 2.4.184 related to insecure organization logo uploads due to a lack of checks for file extension and MIME type.
- CVE-2023-50918Critical
In app/Controller/AuditLogsController.php in MISP before version 2.4.182, ACLs for audit logs are mishandled.
- CVE-2023-48659Critical
An issue was discovered in MISP before version 2.4.176 related to mishandling parameter parsing in app/Controller/AppController.php.
- CVE-2022-29528Critical
An issue was discovered in MISP before version 2.4.158 related to PHAR deserialization.
- CVE-2021-39302Critical
MISP version 2.4.148, in certain configurations, allows SQL injection via the $conditions['org'] value in the app/Model/Log.php file.
Original NVD description (English source)
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configured destination URL. Because the destination did not end with /, attacker-controlled path content was appended directly to the hostname rather than to its URL path. For example, a request resembling: http://misp.example/@attacker.example/ could result in a redirect resembling: https://[email protected]/ Under standard URL parsing, misp.example is interpreted as user information and attacker.example as the destination host. An unauthenticated remote attacker could therefore construct a URL hosted under the legitimate MISP domain that redirects users to an attacker-controlled website. The vulnerability could be used for phishing, credential collection, or potentially disclosing sensitive query-string information preserved during the redirect. Exploitation requires a user to follow the crafted HTTP URL. The fix adds the missing trailing slash to the redirect destination, ensuring that appended request data remains part of the path on the configured MISP host. Existing installationsExisting MISP installations should review their Apache HTTP virtual-host configuration and ensure that the HTTPS redirect destination ends with a trailing slash: Redirect permanent / https://misp.example/ After updating the configuration, validate it with apachectl configtest and reload or restart Apache for the change to take effect