CVE-2026-86351: MISP Information Disclosure Vulnerability

CVE-2026-86351 Overview

CVE-2026-86351 is an input validation flaw in the Malware Information Sharing Platform (MISP) that allows an authenticated user to store a protocol-relative URL as their homepage setting. Affected versions validate the homepage value by checking only that the string begins with /, which permits payloads such as //attacker.example that browsers resolve to an external origin. After login, the stored value is emitted to the Location header or rendered as a bare href, redirecting the user off-site.

The issue affects MISP versions ≤2.5.45 and is tracked under [CWE-20: Improper Input Validation].

Critical Impact
Authenticated attackers can persist an open-redirect payload in a victim's user settings, enabling phishing chains that abuse trust in the MISP origin after successful login.

Affected Products

MISP (Malware Information Sharing Platform) versions ≤2.5.45
misp-project:misp package as distributed via upstream releases
Deployments exposing user-configurable homepage settings to multi-tenant users

Discovery Timeline

2026-09-07 - CVE-2026-86351 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86351

Vulnerability Analysis

MISP allows each user to configure a homepage path that the application redirects to after login. The pre-patch validator accepts any string beginning with /, treating it as a local path. Browsers, however, interpret a leading // as a protocol-relative URL where the following token is a host. A stored value of //attacker.example therefore navigates the browser to https://attacker.example rather than a MISP-local route.

Two controllers consume the stored homepage. AppController writes it into the response used for post-login routing. NewsController emits the value as a bare href in News/index.ctp, meaning the off-site link renders regardless of how MISP.baseurl is configured. Both paths become vectors for open redirect and, in phishing scenarios, credential harvesting on a lookalike host.

Root Cause

The root cause is insufficient URL validation. Checking only the first character does not distinguish between an absolute local path (/events/index) and a protocol-relative URL (//attacker.example). The application also failed to revalidate previously stored settings on read, allowing legacy or internally written unsafe values to bypass any storage-time checks.

Attack Vector

An authenticated user with permission to modify their own user settings stores a crafted homepage value. On subsequent logins, or when the news banner renders, MISP emits the attacker-controlled URL. A victim who clicks or is automatically redirected leaves the MISP origin without a scheme prompt or origin change warning.

php

// Patched controller logic - AppController.php
// Source: https://github.com/MISP/MISP/commit/bd454f65a
$homepagePath = $this->User->UserSetting->getHomepagePath($user['id']);
if ($homepagePath !== '') {
    $this->set('homepage', array('path' => $homepagePath));
}

The fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, a scheme, userinfo, unsafe leading // or /\, malformed URLs, and control characters. It also revalidates homepage settings on read so previously stored unsafe values cannot bypass the new logic.

Detection Methods for CVE-2026-86351

Indicators of Compromise

User setting rows in the user_settings table where setting = 'homepage' and the value begins with //, /\, or contains a scheme such as http: or javascript:.
Web server access logs showing Location: response headers pointing to external hosts immediately after /users/login requests.
Rendered HTML from News/index.ctp containing an href attribute with a protocol-relative or off-site URL.

Detection Strategies

Query the MISP database for any UserSetting entry named homepage whose value does not match the expected pattern of a single-slash absolute path with no additional host component.
Inspect reverse proxy or WAF logs for post-login redirects whose Location header host differs from the MISP FQDN.
Correlate user setting modification events with subsequent login events to identify accounts that recently changed their homepage value.

Monitoring Recommendations

Alert on modifications to the homepage user setting, especially values containing //, backslashes, or control characters.
Monitor outbound redirects from the MISP Location header for domains outside the trusted allowlist.
Track anomalous login-to-external-navigation sequences for accounts with elevated privileges.

How to Mitigate CVE-2026-86351

Immediate Actions Required

Upgrade MISP to a release above 2.5.45 that includes commit bd454f65a.
Audit the user_settings table and delete or normalize any homepage entries that do not resolve to a single-slash local path.
Review recently modified user settings and rotate credentials for accounts that stored suspicious homepage values.

Patch Information

The upstream fix is delivered in the MISP repository via commit bd454f65a. It adds the shared InternalRedirectValidator, applies it during both storage and read of the homepage setting, and updates AppController and NewsController to consume the sanitized path via getHomepagePath().

Workarounds

Restrict the ability to modify user settings to trusted operators until the patch is deployed.
Configure a reverse proxy rule that rewrites or blocks post-login Location headers pointing to external hosts.
Enforce a Content Security Policy (CSP) that limits navigation and framing to the MISP origin.

bash

# Example: identify affected homepage values via MySQL
mysql -u misp -p misp -e "\
  SELECT user_id, value FROM user_settings \
  WHERE setting = 'homepage' \
  AND (value LIKE '//%' OR value LIKE '/\\\\%' OR value REGEXP '^[a-zA-Z]+:');"