CVE-2026-86440

Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stored configuration controlled by a user. The previous renderer considered a URL safe if it appeared relative or if its parsed hostname matched the configured MISP hostname. That logic failed to reject dangerous schemes and URL forms that browsers normalize differently from PHP's URL parsing. As a result, values such as javascript: URLs or backslash-based authority forms could reach the generated anchor's href and execute script or navigate to an attacker-controlled origin when another user interacted with the widget. The upstream commit describes the issue as: “javascript: and backslash URLs reached the href (stored XSS)”. The fix routes widget URLs through a shared DashboardURLValidator, rejects dangerous schemes, raw backslashes, control characters, and unauthorized absolute origins, and validates the URL both in the widget handler and renderer. Version affected: ≤2.5.45

• CWE-20
• CWE-79

• https://github.com/MISP/MISP/commit/adf704e94

Published

Sep 7, 2026

Last Modified

Sep 8, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86435commonmark versions from 1.5.0 before 2.8.4 contain a denial…7.5
• CVE-2026-86436Lara Dashboard before 1.3.2 fails to authorize access to the…5.4
• CVE-2026-86437Lara Dashboard before 1.3.2 authorizes the POST /admin/setti…7.2
• CVE-2026-86438Lara Dashboard before 1.3.2 fails to authorize the Marketpla…7.2
• CVE-2026-86439knowns versions before 0.30.0 fail to validate filesystem pa…8.8
• CVE-2026-8644IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …9.1
• CVE-2026-86441Affected versions of MISP contain inconsistent authorization…2.3
• CVE-2026-86451Affected versions of MISP allow authenticated users to retri…5.3
• CVE-2026-86452Affected versions of MISP permit unauthenticated or weakly c…8.7
• CVE-2026-8646IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphe…9.1
• CVE-2026-86469A flaw was found in GLib2. When g_file_replace() is used wit…5.3
• CVE-2026-8647Crypt::ScryptKDF versions through 0.010 for Perl uses insecu…4.8