Loading story…
The Canadian Centre for Cyber Security warned that MISP 2.5.45 and earlier are affected by one or more vulnerabilities and urged administrators to apply vendor updates. MISP subsequently released version 2.5.46, delivering security hardening that includes fixes for sharing-group authorization, outbound-request validation, authentication and session handling, CSRF/XSS protections, logging, throttling, and file-deletion safeguards.
A corrected sharing-group validation path now explicitly rejects empty sharing_group_id values and verifies that users may use a submitted group, preventing a fail-open condition in which a missing or falsy ID could return the user's full authorized sharing-group list. The release also adds a shared URL egress validator and strengthens the HTTP client to mitigate SSRF exposure through destination restrictions, redirect controls, response-size limits, and TLS peer verification enabled by default; organizations operating MISP should upgrade to 2.5.46 and review vendor guidance.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
MISP released version 2.5.46 with security hardening including outbound-request validation and SSRF protections, stronger authentication, authorization, CSRF and XSS defenses, and sharing-group authorization improvements. The release also included performance improvements, data updates, and usability fixes; administrators were recommended to update.
The Canadian Centre for Cyber Security published advisory AV26-901 concerning vulnerabilities affecting MISP 2.5.45 and earlier. It advised administrators and users to review vendor information and apply necessary updates when available.
MISP versions 2.5.45 and earlier were reported as affected by one or more vulnerabilities as of September 4, 2026. The available advisory information did not specify CVEs, severity, exploitation status, or a fixed version.
Italy's ACN reported that MISP security updates remediate two vulnerabilities affecting versions before 2.5.46. One is rated high severity and could allow a malicious user to bypass security restrictions on affected systems.
MISP introduced a centralized SharingGroup::canUse() authorization check that rejects empty sharing-group IDs and validates that the submitted ID matches a sharing group authorized for the user. Controllers were updated to consistently validate supplied sharing-group IDs, preventing the prior fail-open behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcemisp-project.org
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
National cybersecurity authorities warned of a **critical vulnerability** in **MISP** (Malware Information Sharing Platform), affecting versions prior to **`v2.5.39`**. Belgium's Centre for Cybersecurity issued an urgent advisory telling organizations to patch immediately, while Canada's Centre for Cyber Security said MISP had published a security advisory covering the flaws and identified **`v2.5.39`** as the fixed release. The notices urge administrators and users running vulnerable MISP deployments to review the vendor's advisory and apply the update without delay. Organizations using MISP for threat-intelligence sharing face elevated risk until systems are upgraded, making prompt remediation and verification of deployed versions a priority.
Jun 29, 2026
MISP-related products were flagged for a vulnerability affecting website routes used to query external MISP instances, and CERT-PY published an advisory warning organizations about the issue. The exposed functionality involved the `/fetch_misp_event` and `/misp_search_events` endpoints, which could be reached without authentication and interacted with remote MISP servers, creating risk around unauthorized use and server-side request handling. A corresponding code change in `MISP/cti-transmute` hardened those routes by adding **authentication requirements** and stricter validation of external MISP URLs. The patch now resolves hostnames to all associated IP addresses and rejects targets if any address is not globally routable, blocking access to private, loopback, link-local, or reserved destinations and reducing **SSRF** exposure through DNS names; project notes also state that while DNS rebinding or post-validation DNS changes may still allow limited probing, response bodies remain constrained by TLS hostname validation and disabled redirects.
Aug 11, 2026
A high-severity server-side request forgery flaw tracked as **`CVE-2026-73160`** was disclosed in MISP's **cti-transmute** component, affecting the **`/fetch_misp_event`** and **`/misp_search_events`** endpoints. The issue stemmed from validation that blocked direct private or reserved IP literals but still accepted ordinary hostnames without resolving them first, allowing an unauthenticated attacker to supply a domain that resolved to an internal address and force the server to send requests into its internal network and return the responses. The vulnerability is rated **CVSS 4.0 8.7 (High)** and is mapped to **`CWE-918`**. MISP addressed the flaw by updating URL validation to resolve hostnames with **`socket.getaddrinfo()`** and reject targets if any resolved address is not globally routable, covering private, loopback, link-local, and reserved destinations. The fix also added **login protection** to both affected routes, reducing exposure of functionality that queries external MISP instances. Project notes indicate some residual DNS rebinding or post-validation DNS swap risk may remain for limited probing, but response-body exposure is constrained because valid TLS certificates are required for the hostname and redirects are not followed.
Aug 11, 2026