CVE-2026-54359: MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default

Synopsis

This is a cross-site request forgery (CSRF) vulnerability in MISP, the open-source threat intelligence platform. The flaw stems from an insecure default configuration: the Security.check_sec_fetch_site_header control is off by default, meaning MISP does not validate the browser-provided Sec-Fetch-Site header on state-changing requests such as POST, PUT, or AJAX calls. An unauthenticated remote attacker who tricks an authenticated MISP user into visiting a malicious page can forge requests that MISP processes with the victim's privileges, enabling unauthorized modification of MISP data or configuration. A patched-image rebuild at version 2.5.40 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the victim over the network, delivering a malicious web page that the victim's browser loads while they hold an active MISP session.

• AuthenticationNot required

  The attacker does not need any account or credentials on the MISP instance; the forged requests ride on the victim user's existing authenticated session.

• Victim interactionRequired

  The victim must visit an attacker-controlled web page while logged into MISP, providing the browser context needed to issue the forged cross-site requests.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim visits the malicious page; no race conditions or environmental factors are required.

Blast Radius

• The attacker can modify MISP event data, indicators of compromise, or sharing rules using the victim's privileges.
• Configuration changes, such as enabling integrations or altering user permissions, can be made by forging requests to MISP administration endpoints.
• Subordinate system integrity (SI:L) is also at risk, meaning objects in systems connected to MISP, such as downstream feeds or export targets, may be indirectly affected by corrupted or tampered data pushed from MISP.