CVE-2026-67178: MISP Apache Configuration CSRF Vulnerability

CVE-2026-67178 Overview

CVE-2026-67178 is an open redirect vulnerability in the Malware Information Sharing Platform (MISP) installation scripts. The scripts generated an Apache HTTP virtual-host configuration with a malformed Redirect permanent directive that omitted a trailing slash on the destination URL. Because Apache appends any path after the matched prefix directly to the destination, attacker-controlled input becomes part of the hostname rather than the URL path. An unauthenticated remote attacker can craft URLs hosted under a legitimate MISP domain that redirect users to an attacker-controlled site. The flaw is categorized as URL Redirection to Untrusted Site [CWE-601].

Critical Impact
Attackers can abuse the malformed Apache redirect to send victims from a trusted MISP domain to an arbitrary external host, enabling phishing, credential harvesting, and disclosure of sensitive query-string data.

Affected Products

MISP installations deployed using the bundled INSTALL.debian12.sh installer script
MISP installations deployed using the bundled INSTALL.debian13.sh installer script
Existing MISP deployments whose Apache virtual-host configuration contains Redirect permanent / https://misp.example without a trailing slash

Discovery Timeline

2026-07-28 - CVE-2026-67178 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-67178

Vulnerability Analysis

The vulnerability stems from Apache's handling of the Redirect directive. When Apache matches the configured prefix, it appends the remaining request path to the destination URL string. If the destination lacks a trailing slash, the appended content becomes part of the authority component of the resulting URL rather than the path.

A request to http://misp.example/@attacker.example/ triggers a redirect to https://misp.example@attacker.example/. Under RFC 3986 URL parsing, misp.example is interpreted as userinfo and attacker.example becomes the destination host. The victim's browser follows the redirect to the attacker-controlled domain while the initial URL displays the legitimate MISP hostname.

Exploitation requires only that a user click a crafted HTTP link. Any query-string data preserved during the redirect may also leak to the attacker's server.

Root Cause

The installation scripts wrote the Apache virtual-host stanza with Redirect permanent / https://$MISP_DOMAIN instead of Redirect permanent / https://$MISP_DOMAIN/. The missing trailing slash on the destination caused Apache to concatenate attacker-controlled path segments directly onto the hostname, producing a syntactically valid URL with attacker-controlled authority.

Attack Vector

The attack requires an unauthenticated attacker to distribute a crafted HTTP URL pointing at the MISP host, typically through phishing email or a malicious webpage. When a victim clicks the link, the MISP server responds with a 301 redirect whose Location header points to the attacker's domain. The redirect can carry authenticated session cookies for the attacker's domain, referer data, and query-string parameters intended for MISP.

bash

# Patch to INSTALL/INSTALL.debian12.sh and INSTALL/INSTALL.debian13.sh
           ServerAdmin admin@$MISP_DOMAIN
           ServerName $MISP_DOMAIN
 
-          Redirect permanent / https://$MISP_DOMAIN
+          Redirect permanent / https://$MISP_DOMAIN/
 
           LogLevel warn
           ErrorLog /var/log/apache2/misp.local_error.log
# Source: https://github.com/MISP/MISP/commit/15becd3b21245ddc6a8b5dad46e983ade405ddf8

Detection Methods for CVE-2026-67178

Indicators of Compromise

Apache access logs containing HTTP requests to the MISP host with paths beginning with /@ followed by an external domain, such as GET /@attacker.example/ HTTP/1.1.
301 redirect responses whose Location header contains an @ character between the MISP hostname and another domain.
Referer entries on external domains identifying the MISP host as the origin of user traffic.

Detection Strategies

Inspect the running Apache configuration for Redirect permanent / https://<host> entries missing a trailing slash and flag them for remediation.
Parse Apache access logs with regular expressions that identify request paths matching ^/@[^/]+\. to detect attempts to abuse the redirect.
Correlate outbound HTTP referrals from the MISP host with the domain allowlist to identify redirects to unknown external destinations.

Monitoring Recommendations

Alert on any 3xx response from the MISP virtual host whose Location header points to a hostname outside the organization's trusted domain list.
Monitor threat intelligence feeds and phishing telemetry for URLs referencing the MISP domain with embedded @ characters.
Track user reports of unexpected redirects from the MISP interface and route them to the incident response queue.

How to Mitigate CVE-2026-67178

Immediate Actions Required

Review the Apache virtual-host configuration for the MISP site and add the missing trailing slash to any Redirect permanent / directive.
Run apachectl configtest to validate the updated configuration, then reload or restart Apache to apply the change.
Re-run any recent installation of MISP from the updated installer scripts to ensure the corrected redirect is in place.

Patch Information

The fix is committed upstream in the MISP repository at commit 15becd3b21245ddc6a8b5dad46e983ade405ddf8, which updates INSTALL/INSTALL.debian12.sh and INSTALL/INSTALL.debian13.sh to append / to the redirect destination. See the MISP security commit for the full diff.

Workarounds

Manually edit the Apache virtual-host file to change Redirect permanent / https://misp.example to Redirect permanent / https://misp.example/ on existing deployments.
Alternatively, replace the Redirect directive with a RedirectMatch ^/$ https://misp.example/ rule that only matches the root path.
Disable the plain HTTP virtual host entirely and require clients to connect over HTTPS directly if the redirect is not needed.