CVE-2026-54359

MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is disabled, state-changing requests such as POST, PUT, or AJAX requests are not restricted based on the browser-provided Sec-Fetch-Site header. A remote unauthenticated attacker could craft a malicious web page that causes an authenticated MISP user’s browser to issue cross-site requests to MISP automation endpoints. If successful, the forged requests may be processed with the privileges of the victim user, potentially allowing unauthorized modification of MISP data or configuration. Enabling Security.check_sec_fetch_site_header mitigates this issue, although operators of multi-homed MISP deployments should validate the setting before enforcing it.

• CWE-352
• CWE-1188

• https://github.com/MISP/MISP/commit/b82db1bcaa550689c05e1ed175e81f25a8d97b91

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54350Budibase is an open-source low-code platform. Prior to 3.39.…9.8
• CVE-2026-54351Budibase is an open-source low-code platform. Prior to 3.39.…9.6
• CVE-2026-54352Budibase is an open-source low-code platform. Prior to 3.39.…9.6
• CVE-2026-54353Budibase is an open-source low-code platform. Prior to 3.39.…7.1
• CVE-2026-54357An improper authorization vulnerability in MISP allowed an a…5.1
• CVE-2026-54358An incorrect authorization vulnerability in MISP allows an o…7.5
• CVE-2026-5436The MW WP Form plugin for WordPress is vulnerable to Arbitra…8.1
• CVE-2026-54360A mass assignment vulnerability exists in MISP’s sharing gro…8.4
• CVE-2026-54361MISP contained multiple mass assignment vulnerabilities in t…8.8
• CVE-2026-54362An incorrect visibility condition in the MISP event template…5.3
• CVE-2026-54363CentreStack before 17.5 contains a hardcoded cryptographic k…9.3
• CVE-2026-54364CentreStack before 17.4 contains a session variable injectio…6.9