CVE-2026-104901: MISP ID Translator XSS Vulnerability

CVE-2026-104901 Overview

CVE-2026-104901 is a stored cross-site scripting (XSS) vulnerability in the Malware Information Sharing Platform (MISP) ID Translator feature. The flaw affects MISP versions prior to 2.5.48. When an authenticated user opens the ID Translator page, MISP queries linked remote servers for corresponding event identifiers and renders the returned event ID in HTML without output encoding. A malicious or compromised linked server can return a crafted event ID that embeds arbitrary HTML or JavaScript. The payload executes in the browser of any host-organization user viewing the page.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and other client-side attacks against authenticated MISP users, including administrators who routinely preview remote events.

Affected Products

MISP (Malware Information Sharing Platform) versions prior to 2.5.48
MISP instances with one or more linked remote servers configured
MISP host organizations whose users access the ID Translator page

Discovery Timeline

2026-10-02 - CVE-2026-104901 published to the National Vulnerability Database
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104901

Vulnerability Analysis

The vulnerability is a reflected-to-stored XSS pattern rooted in improper neutralization of input during web page generation [CWE-79]. MISP's ID Translator feature fetches event identifiers from linked remote servers and inserts them directly into the rendered HTML. Because the host instance implicitly trusts data returned from configured peer servers, no sanitization or output encoding was applied to the remote_id field before it was concatenated into anchor tag content and attributes.

An attacker controlling a linked MISP server can return an event ID string containing HTML markup such as <script> tags or event handlers. When a victim in the host organization navigates to the ID Translator view for a given event, the browser parses and executes the attacker-controlled markup within the MISP origin. This grants the attacker access to session cookies, CSRF tokens, and any data accessible to the victim through the MISP web interface.

Root Cause

The affected view template app/View/Servers/id_translator.ctp emitted the remote_id value without passing it through MISP's h() output-encoding helper. Additionally, the controller app/Controller/ServersController.php did not coerce the remote identifier to an integer, allowing arbitrary string payloads to propagate from the server response into the DOM.

Attack Vector

Exploitation requires three preconditions: the host MISP instance has a linked server configured, the linked server is attacker-controlled or compromised, and an authenticated host-organization user visits the ID Translator page for an event. The attack vector is network-based, requires user interaction, and does not require privileges on the host instance.

php

// Patch: app/Controller/ServersController.php
// Coerce remote event ID to integer before use
$remote_events[] = array(
    "server_id" => $remote_server['Server']['id'],
    "server_name" => $remote_server['Server']['name'],
    "url" => $remote_server['Server']['url']."/events/view/".(int)$remote_event['id'],
    "remote_id" => (int)$remote_event['id'],
    "exception" => null,
);

// Patch: app/View/Servers/id_translator.ctp
// Apply h() output encoding to remote_id and server_id
$value = __('Remote ID:') . ' <a href="'.h($remote_event['url']).'" rel="noreferrer noopener" target="_blank">' . h($remote_event['remote_id']) . '</a>';
if ($isSiteAdmin) {
    $value .= ' (<a href="' . $baseurl . '/servers/previewEvent/' . h($remote_event['server_id']) . '/' . h($remote_event['remote_id']) . '">' . __('preview') .  '</a>)';
}

Source: MISP commit bd5e80c84

Detection Methods for CVE-2026-104901

Indicators of Compromise

Non-integer values returned in the id field of /events/index or event-lookup responses from linked MISP servers.
HTTP responses from peer MISP servers containing HTML or JavaScript markup within event identifier fields.
Unexpected outbound requests from MISP users' browsers to attacker-controlled hosts following access to the ID Translator page.

Detection Strategies

Inspect reverse-proxy or MISP application logs for sync requests to /servers/getRemoteId and correlate response bodies against expected numeric event IDs.
Deploy a Content Security Policy (CSP) report-only endpoint on the MISP web interface and alert on violations originating from the ID Translator route.
Review the configured linked server list in MISP and validate the trust level and ownership of each remote endpoint.

Monitoring Recommendations

Monitor authenticated MISP user sessions for anomalous API calls or data exports immediately after ID Translator access.
Alert on changes to the linked servers configuration table within the MISP database.
Track browser telemetry on administrator workstations for script execution anomalies on MISP origins.

How to Mitigate CVE-2026-104901

Immediate Actions Required

Upgrade MISP to version 2.5.48 or later, which applies output encoding and integer coercion to remote event identifiers.
Audit all configured linked servers and remove or disable any peer whose operator or infrastructure cannot be verified.
Rotate session cookies and API keys for host-organization users who accessed the ID Translator page while vulnerable versions were deployed.

Patch Information

The fix is delivered in MISP commit bd5e80c84, which modifies app/Controller/ServersController.php to cast remote_event['id'] to an integer and updates app/View/Servers/id_translator.ctp to apply the h() HTML-escaping helper to remote_id and server_id. See the MISP commit log for the complete diff.

Workarounds

Temporarily disable the ID Translator functionality by restricting access to the /servers/idTranslator route at the reverse proxy until patching is complete.
Remove linked remote server configurations from untrusted or unverified operators until the upgrade is applied.
Enforce a strict Content Security Policy that disallows inline script execution on the MISP web interface.

bash

# Example nginx snippet to block the ID Translator route pre-patch
location ~ ^/servers/idTranslator {
    return 403;
}

# Verify MISP version after upgrade
cd /var/www/MISP && git describe --tags
# Expected: v2.5.48 or later