CVE-2026-86419

Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation. The TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator. Together, these commits harden MISP's outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding. Version affected: ≤2.5.45

• CWE-200
• CWE-918

• https://github.com/MISP/MISP/commit/06f541dcf
• https://github.com/MISP/MISP/commit/08d6efe24

Published

Sep 7, 2026

Last Modified

Sep 8, 2026

Status

Undergoing Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8637A potential uncontrolled search path vulnerability was repor…8.5
• CVE-2026-86404EAP's Artemis deserialization configuration permits deserial…8.8
• CVE-2026-86408Affected versions of MISP do not enforce parent-event visibi…7.1
• CVE-2026-86416ILIAS versions before 9.23, 10.11, and 11.4 contain an autho…5.4
• CVE-2026-86417Affected versions of MISP inconsistently enforced email-addr…5.3
• CVE-2026-86418Affected versions of MISP expose organisation metadata throu…2.3
• CVE-2026-86420ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly …3.7
• CVE-2026-86421ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory …3.7
• CVE-2026-86422ImageMagick before 7.1.2-30 contains a time-of-check-time-of…3.3
• CVE-2026-86423ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 conta…3.3
• CVE-2026-86424ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of…2.5
• CVE-2026-86425ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 conta…3.3