CVE-2026-86419 MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
Attackers can exploit insufficient URL validation in MISP feeds and TAXII discovery to perform SSRF and leak credentials via redirects.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86419?
CVE-2026-86419 is a high-severity server-side request forgery vulnerability in Misp-Project Misp, published on 7 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality.
In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused across redirect hops, meaning authentication headers or API credentials configured for a feed could be forwarded to a different host. Redirects could also target internal network resources, resulting in SSRF. The fix adds redirect validation, blocks internal destinations for cross-host redirects, strips configured feed credentials before following redirects to another host, and pins validated DNS results to prevent re-resolution after validation.
The TAXII discovery endpoint had a related incomplete SSRF defense. It used gethostbyname() and compared the result against only a few literal addresses. This missed cases including IPv6 loopback (::1), numeric host encodings such as 0x7f000001, and potentially multiple DNS records. The fix moves TAXII discovery to the shared URL egress validator.
Together, these commits harden MISP's outbound URL handling against alternate-address representations, DNS-related bypasses, unsafe redirects, internal-host access, and cross-host credential forwarding.
Version affected: ≤2.5.45
Which versions are affected by CVE-2026-86419?
It affects 1 product.
Products include Misp-Project Misp.
How do I fix CVE-2026-86419?
No fix has been published for CVE-2026-86419 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-86419 being exploited?
There is no known exploitation of CVE-2026-86419 in the wild and no public exploit code.
Other vulnerabilities in Misp-Project Misp
Sources
Also known as GHSA-qp9m-r348-236g.