Loading story…
The Canadian Centre for Cyber Security warned that MISP CTI-Transmute versions <= 1.4.0 are affected by multiple vulnerabilities, including CVE-2026-69082 and **CVE-2026-69079. One flaw allows **cross-site request forgery (CSRF)** against the administrative user-deletion endpoint because /account/delete/<id>accepted HTTPGET` requests for a state-changing action, letting an attacker trick a logged-in administrator into deleting a chosen user account. The issue could cause unauthorized state changes, denial of access for affected users, and potential disruption if administrator accounts are targeted.
A second high-severity flaw allows unauthenticated denial of service through the /activity_timeline endpoint, where an unbounded days parameter could be abused to force excessive database, CPU, and memory consumption and degrade site availability. The advisory also referenced remediation for blocking file and network fetches during evaluation PDF rendering, alongside fixes that cap the timeline range and require POST plus CSRF protection for user deletion. Administrators were urged to review the linked fixes and apply updates as they become available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-775 stating that, as of August 3, 2026, MISP was affected by vulnerabilities in the cti-transmute component up to and including version 1.4.0. The notice directed administrators to review linked fixes, including capping the activity-timeline range and requiring POST for user deletion.
A CVE entry was newly received for CVE-2026-69082, a cross-site request forgery issue in CTI-Transmute's administrative user deletion endpoint affecting versions up to and including 1.4.0. The flaw let an unauthenticated attacker trick an authenticated administrator into deleting user accounts via a GET request.
CVE-2026-69079 was published for an unauthenticated denial-of-service vulnerability in CTI-Transmute's /activity_timeline endpoint affecting versions up to and including 1.4.0. The flaw allowed attackers to supply an unbounded days parameter and exhaust database, CPU, and memory resources.
A GitHub commit in MISP's cti-transmute project changed the /account/delete/<int:id> route to accept only POST requests and updated the admin user detail page to submit deletions through a form. The change added a CSRF token to the deletion workflow, addressing the unsafe GET-based user deletion behavior.
A GitHub commit in MISP's cti-transmute project fixed the unauthenticated /activity_timeline endpoint by clamping the days parameter to between 1 and 1,095 days. The change addressed the unbounded input that could tie up the server or trigger a 500 error.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity server-side request forgery flaw tracked as **`CVE-2026-73160`** was disclosed in MISP's **cti-transmute** component, affecting the **`/fetch_misp_event`** and **`/misp_search_events`** endpoints. The issue stemmed from validation that blocked direct private or reserved IP literals but still accepted ordinary hostnames without resolving them first, allowing an unauthenticated attacker to supply a domain that resolved to an internal address and force the server to send requests into its internal network and return the responses. The vulnerability is rated **CVSS 4.0 8.7 (High)** and is mapped to **`CWE-918`**. MISP addressed the flaw by updating URL validation to resolve hostnames with **`socket.getaddrinfo()`** and reject targets if any resolved address is not globally routable, covering private, loopback, link-local, and reserved destinations. The fix also added **login protection** to both affected routes, reducing exposure of functionality that queries external MISP instances. Project notes indicate some residual DNS rebinding or post-validation DNS swap risk may remain for limited probing, but response-body exposure is constrained because valid TLS certificates are required for the hostname and redirects are not followed.
Aug 11, 2026
MISP Project released **CTI-Transmute 1.5** with 16 security fixes affecting versions `1.4` and earlier, including four **High** severity flaws. The most serious issues include unauthenticated HTML injection in PDF export that could lead to local file and internal URL access, CSRF that could let an attacker delete administrator accounts, unauthenticated SSRF in remote-MISP fetch routes, and an unauthenticated denial-of-service condition caused by an unbounded activity timeline parameter. Users were urged to upgrade promptly and review release notes because the update also introduces database schema renames, automatic migrations, and HTTP method changes that may affect existing integrations. The release also adds broader hardening measures and platform changes beyond the vulnerability fixes. MISP said version 1.5 introduces a nonce-based **Content Security Policy**, hardened session cookies, safer PDF rendering, resolved-IP validation for remote fetches, and conversion of state-changing `GET` routes to `POST` or `DELETE` with CSRF protection. The update further adds a first-class public API for the conversion catalogue, typed converter parameters, architectural refactoring around a converter registry and service separation, and an expanded automated test suite reaching 516 tests.
Aug 11, 2026
MISP-related products were flagged for a vulnerability affecting website routes used to query external MISP instances, and CERT-PY published an advisory warning organizations about the issue. The exposed functionality involved the `/fetch_misp_event` and `/misp_search_events` endpoints, which could be reached without authentication and interacted with remote MISP servers, creating risk around unauthorized use and server-side request handling. A corresponding code change in `MISP/cti-transmute` hardened those routes by adding **authentication requirements** and stricter validation of external MISP URLs. The patch now resolves hostnames to all associated IP addresses and rejects targets if any address is not globally routable, blocking access to private, loopback, link-local, or reserved destinations and reducing **SSRF** exposure through DNS names; project notes also state that while DNS rebinding or post-validation DNS changes may still allow limited probing, response bodies remain constrained by TLS hostname validation and disabled redirects.
Aug 11, 2026