CVE-2026-54359: MISP CSRF Vulnerability via Insecure Config

CVE-2026-54359 Overview

CVE-2026-54359 is a Cross-Site Request Forgery (CSRF) vulnerability in Malware Information Sharing Platform (MISP) caused by an insecure default configuration. The Security.check_sec_fetch_site_header control ships disabled, leaving state-changing requests unprotected against cross-origin abuse [CWE-352]. A remote unauthenticated attacker can craft a malicious page that forces an authenticated MISP user's browser to issue POST, PUT, or AJAX requests to MISP automation endpoints. The forged requests execute with the victim's privileges and can modify MISP data or configuration.

Critical Impact
Authenticated MISP users visiting attacker-controlled pages may have threat intelligence data or instance configuration silently modified through forged cross-site requests.

Affected Products

MISP (Malware Information Sharing Platform) instances with Security.check_sec_fetch_site_header disabled
All MISP deployments using default security configuration prior to the patched commit
MISP automation endpoints accepting POST, PUT, and AJAX state-changing requests

Discovery Timeline

2026-06-12 - CVE-2026-54359 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54359

Vulnerability Analysis

The vulnerability stems from MISP shipping with Security.check_sec_fetch_site_header set to disabled by default. The Sec-Fetch-Site header is a browser-provided Fetch Metadata signal that indicates whether a request originated from the same site, a cross-site context, or a user navigation. When MISP ignores this header, the server cannot distinguish a legitimate same-origin POST from a forged cross-origin request initiated by a malicious page.

An attacker exploits this by hosting a page that issues background requests to MISP automation endpoints. If a logged-in MISP user visits the page, the browser attaches session cookies and the request executes server-side with the victim's privileges. Targeted endpoints include event creation, attribute modification, user management, and configuration changes.

Root Cause

The root cause is an insecure default configuration. The testSecFetchSiteHeader function added in the patched commit confirms the setting must be explicitly enabled to enforce browser origin checks. The default-off behavior is intentional to support multi-homed deployments hosted under multiple addresses, but it leaves single-domain installations exposed.

Attack Vector

Exploitation requires user interaction. The victim must be authenticated to MISP and must visit an attacker-controlled web page in the same browser session. No credentials, tokens, or prior access to the MISP instance are required by the attacker.

php

         return true;
     }
 
+    public function testSecFetchSiteHeader($value)
+    {
+        if (!empty($value)) {
+            return true;
+        }
+        return 'Sec-Fetch-Site header disabled. This can potentially open up the instance to CSRF attacks via automation endpoints. Enabling this is recommended but can actively prevent the operation of instances hosted under multiple addresses.';
+    }
+
     public function sightingsBeforeHook($setting, $value)
     {
         if ($value == true) {

Source: MISP GitHub Commit b82db1b

Detection Methods for CVE-2026-54359

Indicators of Compromise

Unexpected POST, PUT, or AJAX requests to MISP automation endpoints with Sec-Fetch-Site: cross-site headers in web server logs
Audit log entries showing data or configuration changes that do not correlate with the user's interactive session activity
Referer headers in MISP access logs pointing to external untrusted domains during state-changing operations

Detection Strategies

Parse MISP web server access logs for state-changing HTTP methods accompanied by cross-origin Origin or Referer values
Correlate MISP audit trail entries against user session activity to surface modifications performed without corresponding UI navigation
Alert on the MISP diagnostic warning generated by testSecFetchSiteHeader indicating the setting remains disabled

Monitoring Recommendations

Forward MISP application and web server logs to a centralized analytics platform such as Singularity Data Lake for retention and querying with OCSF normalization
Build identification rules in the SIEM that flag cross-origin requests to /events, /attributes, /users, and /servers endpoints
Monitor administrator account activity and configuration setting changes for anomalous timing or origin patterns

How to Mitigate CVE-2026-54359

Immediate Actions Required

Enable Security.check_sec_fetch_site_header in the MISP server settings to enforce Fetch Metadata-based request validation
Validate the setting in staging environments first if the MISP instance is hosted under multiple addresses or behind multi-homed proxies
Review MISP audit logs for unexpected state changes since the instance was last patched or reconfigured

Patch Information

Apply MISP commit b82db1b which introduces the testSecFetchSiteHeader diagnostic and warns administrators when the setting is left disabled. Pull the latest MISP release that includes this commit and restart the application. Refer to the MISP GitHub Commit for the full change.

Workarounds

Restrict MISP access to trusted networks or VPN-only routing to reduce the population of users exposed to attacker web content
Enforce short session lifetimes and require re-authentication for sensitive administrative actions
Deploy a reverse proxy that strips or validates cross-origin requests to MISP automation endpoints

bash

# Enable the Sec-Fetch-Site header check via MISP CLI
sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting \
  "Security.check_sec_fetch_site_header" true

# Verify the setting was applied
sudo -u www-data /var/www/MISP/app/Console/cake Admin getSetting \
  "Security.check_sec_fetch_site_header"