CVE-2026-85547: MISP Cross-Site Request Forgery Vulnerability

CVE-2026-85547 Overview

CVE-2026-85547 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Malware Information Sharing Platform (MISP). The flaw stems from MISP disabling its form-security and CSRF protections whenever an incoming request is classified as REST traffic. Attackers can influence this classification by supplying an Accept: application/json header, which browsers permit cross-origin without a CORS preflight. An authenticated MISP user who visits a malicious page can therefore be forced to execute state-changing actions under their own session privileges.

Critical Impact
An attacker-controlled page can trigger authenticated state changes in MISP, including unauthorized creation, modification, publication, or deletion of threat intelligence data.

Affected Products

MISP (Malware Information Sharing Platform) versions prior to commit f82646727
MISP instances relying on session-based authentication for web users
MISP deployments exposing REST-style endpoints reachable by browser sessions

Discovery Timeline

2026-09-04 - CVE-2026-85547 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85547

Vulnerability Analysis

MISP grants a form-security and CSRF exemption based on the internal _isRest() heuristic rather than on the credential presented with the request. The heuristic inspects request properties such as the URL suffix and the HTTP Accept header. Because the Accept: application/json header is a CORS-safelisted request header, any cross-origin page can attach it to a fetch or XMLHttpRequest call without triggering a preflight.

When the victim's browser sends such a request, it also carries the victim's existing MISP session cookie. MISP interprets the request as REST traffic, waives CSRF validation, and processes the operation under the victim's identity. Depending on the targeted controller action and the victim's role, this enables unauthorized event publication, tag manipulation, object creation, or record deletion.

Root Cause

The root cause is authorization logic that ties a security exemption to request shape instead of authentication mechanism. The _isRest() check does not verify that a MISP API key was supplied. Session-authenticated requests that merely look like REST calls receive the same CSRF exemption intended only for programmatic API clients presenting an out-of-band credential.

Attack Vector

Exploitation requires an authenticated MISP user to load a malicious page controlled by the attacker. That page issues a cross-origin request to a susceptible MISP endpoint with Accept: application/json and any required body content. The browser attaches the session cookie automatically, and MISP processes the state change without CSRF validation. No prior compromise of the MISP server is required.

php

// Patch excerpt: app/Controller/CollectionElementsController.php
 public $components = ['Session', 'RequestHandler'];

+    public function beforeFilter()
+    {
+        parent::beforeFilter();
+        // Posted by hand-built AJAX from the collection pickers, which sends the
+        // CSRF token as the X-CSRF-Token header instead of _Token fields.
+        $this->_csrfTokenHeaderOnly(['addElementToCollection']);
+    }
+
     public $paginate = [
         'limit' => 60,
         'order' => []
// Source: https://github.com/MISP/MISP/commit/f82646727

The patch introduces _csrfTokenHeaderOnly() so that legitimate same-origin AJAX callers can present the CSRF token via the X-CSRF-Token header. This header is not on the CORS safelist, so a cross-origin page cannot attach it without a preflight that MISP will reject.

Detection Methods for CVE-2026-85547

Indicators of Compromise

MISP audit log entries showing state-changing operations initiated by a browser User-Agent combined with Accept: application/json.
Requests to REST-style MISP endpoints originating with a Referer header pointing to an untrusted third-party domain.
Unexpected creation, modification, or deletion of events, attributes, tags, or collections attributed to interactive users.

Detection Strategies

Inspect reverse proxy or web server logs for POST, PUT, and DELETE requests to MISP where session cookies are present alongside cross-origin Origin or Referer values.
Correlate MISP application audit trails against expected user workflows to identify state changes without corresponding UI navigation.
Alert on high-privilege actions such as event publication or user role changes issued through JSON-suffixed URLs from browser sessions.

Monitoring Recommendations

Enable and centralize MISP audit logging along with front-end HTTP access logs into a SIEM for cross-source correlation.
Baseline normal REST API usage by API key holders so that session-cookie-based REST traffic stands out as anomalous.
Monitor the MISP GitHub repository and security advisories for follow-up fixes referencing commit f82646727.

How to Mitigate CVE-2026-85547

Immediate Actions Required

Update MISP to a release that incorporates commit f82646727, which grants CSRF exemption only when a MISP API key is present.
Audit MISP event, attribute, and user tables for unauthorized modifications since the vulnerability window opened.
Rotate MISP API keys and force re-authentication of interactive users after patching.

Patch Information

The fix is delivered in MISP commit f82646727. It changes the CSRF and form-security exemption logic so that exemptions are granted only when the request actually carries a MISP API key credential. Session-authenticated REST-style requests remain subject to CSRF validation. The patch also adds _csrfTokenHeaderOnly() support so that legitimate same-origin AJAX callers can transmit CSRF tokens through the X-CSRF-Token header, which cross-origin pages cannot attach without a CORS preflight. See the MISP security commit f82646727 for the full diff.

Workarounds

Place MISP behind a reverse proxy that strips or rejects requests bearing a cross-origin Origin or Referer header for state-changing methods.
Restrict MISP web access to trusted networks or VPN users to reduce the population of browsers that can be weaponized against the instance.
Educate MISP users to avoid browsing untrusted sites in the same browser profile used for authenticated MISP sessions until patching is complete.

bash

# Example nginx snippet to block cross-origin state changes to MISP
map $http_origin $misp_allowed_origin {
    default                       "";
    "https://misp.example.internal" $http_origin;
}

server {
    listen 443 ssl;
    server_name misp.example.internal;

    location / {
        if ($request_method ~ ^(POST|PUT|DELETE|PATCH)$) {
            if ($http_origin != "") {
                set $csrf_check "origin";
            }
            if ($misp_allowed_origin = "") {
                return 403;
            }
        }
        proxy_pass http://misp_backend;
    }
}